https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128606#M34919 <P>example</P> <P>[dto=forename: "abcforename"<BR /> surname: "abcsurname" ..................]</P> <P>I want to extract the forename and surname , <BR /> and let them combine as a field USER</P> <P>how?</P> <P>MANY THX. </P> Fri, 06 Feb 2015 03:29:12 GMT joyce1018 2015-02-06T03:29:12Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128606#M34919 <P>example</P> <P>[dto=forename: "abcforename"<BR /> surname: "abcsurname" ..................]</P> <P>I want to extract the forename and surname , <BR /> and let them combine as a field USER</P> <P>how?</P> <P>MANY THX. </P> Fri, 06 Feb 2015 03:29:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128606#M34919 joyce1018 2015-02-06T03:29:12Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128607#M34920 <P>Use a multiline rex.. This will capture everything in the "..".</P> <PRE><CODE>search.... | rex field=_raw "^\[dto=forename\:\s\"(?&lt;fname&gt;.*)\"\nsurname\:\s\"(?&lt;lastname&gt;.*)\"" | table forename lastname </CODE></PRE> <P>Another option would be to use props, set your sourcetype with linemerge=false, and define your event boundaries.</P> Fri, 06 Feb 2015 03:46:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128607#M34920 esix_splunk 2015-02-06T03:46:56Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128608#M34921 <P>You would have to tune the regex to match your requirement but the query would be somewhat like below</P> <PRE><CODE>.. | rex field=fieldnamehere "dto\=forename\:\s\"(?&lt;fname&gt;\w+)\"\ssurname\:\s\"(?&lt;sname&gt;\w+)\"" | eval merged=fname." ".sname </CODE></PRE> Fri, 06 Feb 2015 03:47:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-data-after-a-colon/m-p/128608#M34921 ramdaspr 2015-02-06T03:47:35Z