https://community.splunk.com/t5/Splunk-Search/Duplicate-nested-KV-s/m-p/149370#M41771 <P>Success!<BR /> rex field=Resource_List_select "(?i):node_class=(?P<NODE_CLASS>[^ /+/:]+)"</NODE_CLASS></P> Mon, 28 Sep 2020 17:07:46 GMT mjones414 2020-09-28T17:07:46Z https://community.splunk.com/t5/Splunk-Search/Duplicate-nested-KV-s/m-p/149369#M41770 <P>Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48</P> <P>Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended. </P> <P>The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.</P> <P>The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?<NODE_CLASS>.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.</NODE_CLASS></P> <P>How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :</P> Mon, 28 Sep 2020 17:07:37 GMT https://community.splunk.com/t5/Splunk-Search/Duplicate-nested-KV-s/m-p/149369#M41770 mjones414 2020-09-28T17:07:37Z https://community.splunk.com/t5/Splunk-Search/Duplicate-nested-KV-s/m-p/149370#M41771 <P>Success!<BR /> rex field=Resource_List_select "(?i):node_class=(?P<NODE_CLASS>[^ /+/:]+)"</NODE_CLASS></P> Mon, 28 Sep 2020 17:07:46 GMT https://community.splunk.com/t5/Splunk-Search/Duplicate-nested-KV-s/m-p/149370#M41771 mjones414 2020-09-28T17:07:46Z