https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168225#M47953 <P>add a <CODE>| sort network-srcinfo</CODE> at the end </P> Thu, 05 Mar 2015 09:20:23 GMT MuS 2015-03-05T09:20:23Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168222#M47950 <P>I have a logline that is extracted in multiple fields already. 1 of those fields contain multiple strings on different lines.<BR /> I would like to extract certain strings from these lines, and add them to a single field.</P> <P>example log:</P> <P>source=10.0.0.1<BR /> destination=10.0.0.2<BR /> action=deny<BR /> extra=rule number 1<BR /> xlated_source:192.168.0.1<BR /> xlated_destination:10.0.0.2<BR /> source_info:the source is part of group /source/network/LAN<BR /> source_info:the source is part of group /source/network/LAN-Tulsa<BR /> source_info:the source is part of group /source/network/LAN-printers<BR /> dest_info:the destination is part of group /destination/network/LAN<BR /> dest_info:the destination is part of group /destination/network/LAN-DC</P> <P>as a result I would like to have the following new fields extracted from the "extra" field:<BR /> network-srcinfo=LAN,LAN-Tulsa,LAN-printers<BR /> network-dstinfo=LAN,LAN-DC</P> <P>when I do a:</P> <PRE><CODE>| rex field=_raw "/source/network/(?\.*)" </CODE></PRE> <P>I only get:</P> <PRE><CODE>network-srcinfo=LAN </CODE></PRE> <P>I'm quite new to splunk, and I can't seem to find an answer to this.</P> Mon, 28 Sep 2020 19:06:59 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168222#M47950 mikegdlw 2020-09-28T19:06:59Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168223#M47951 <P>Try something like this:</P> <PRE><CODE>| rex max_match=0 field=_raw "\/source\/network\/(?&lt;network-srcinfo&gt;.*)" | table network-srcinfo </CODE></PRE> Wed, 04 Mar 2015 12:01:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168223#M47951 MuS 2015-03-04T12:01:26Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168224#M47952 <P>Thank you! that fixed my issue.</P> <P>Of course, now a new one popped up. It seems that within the logs, things are not as consistent as I thought.<BR /> so it can indeed show up as:<BR /> source_info:the source is part of group /source/network/LAN<BR /> source_info:the source is part of group /source/network/LAN-Tulsa<BR /> source_info:the source is part of group /source/network/LAN-printers</P> <P>but also in other combinations:<BR /> source_info:the source is part of group /source/network/LAN-Tulsa<BR /> source_info:the source is part of group /source/network/LAN<BR /> source_info:the source is part of group /source/network/LAN-printers</P> <P>is there a way to do an alphabetical sort within the network-srcinfo field? <BR /> otherwise the results would be that "LAN, LAN-Tulsa, LAN-printers" is seen as different than "LAN-Tulsa, LAN, LAN-printers" while in essence, this is not the case</P> Mon, 28 Sep 2020 19:07:04 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168224#M47952 mikegdlw 2020-09-28T19:07:04Z https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168225#M47953 <P>add a <CODE>| sort network-srcinfo</CODE> at the end </P> Thu, 05 Mar 2015 09:20:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-extract-multiple-strings-from-multiple-lines-into-1-field/m-p/168225#M47953 MuS 2015-03-05T09:20:23Z