topic Re: How to write the regex to extract these 2 fields from this result? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281896#M85078 <P>Like this</P> <PRE><CODE>... | rex max_match=0 "UDP+PORT=(?&lt;udp&gt;\d+)" | rex max_match=0 "TCP_PORT=(?&lt;tcp&gt;\d+)" | eval z=mvzip(udp, tcp) | mvexpand z | table udp tcp </CODE></PRE> Mon, 06 Jun 2016 17:17:28 GMT sundareshr 2016-06-06T17:17:28Z How to write the regex to extract these 2 fields from this result? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281895#M85077 <P>Hi all,</P> <P>How to extract the fields <STRONG>UDP_PORT</STRONG> and <STRONG>TCP_PORT</STRONG> from this result?</P> <PRE><CODE>FIXED_SEVERITY_3=10, FIXED_SEVERITY_2=14, CONFIRMED_SEVERITY_2=13, CONFIRMED_SEVERITY_3=9, CONFIRMED_SEVERITY_1=3, ACTIVE_SEVERITY_3=2, CONFIRMED_SEVERITY_4=1, ACTIVE_SEVERITY_1=1, SCAN_DURATION=1647, UDP_PORT=123, UDP_PORT=514, TCP_PORT=22, TCP_PORT=514, TCP_PORT=5520, TCP_PORT=8000, TOTAL_VULNS=46 </CODE></PRE> Mon, 06 Jun 2016 17:03:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281895#M85077 kranthi851 2016-06-06T17:03:17Z Re: How to write the regex to extract these 2 fields from this result? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281896#M85078 <P>Like this</P> <PRE><CODE>... | rex max_match=0 "UDP+PORT=(?&lt;udp&gt;\d+)" | rex max_match=0 "TCP_PORT=(?&lt;tcp&gt;\d+)" | eval z=mvzip(udp, tcp) | mvexpand z | table udp tcp </CODE></PRE> Mon, 06 Jun 2016 17:17:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281896#M85078 sundareshr 2016-06-06T17:17:28Z Re: How to write the regex to extract these 2 fields from this result? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281897#M85079 <P>One of these should do.</P> <PRE><CODE>... | rex max_match=0 "UDP_PORT=(?&lt;UPD_PORT&gt;\d+)|TCP_PORT=(?&lt;TCP_PORT&gt;\d+)" | ... ... | extract mv_add=true kvdelim='=' pairdelim=',' | ... </CODE></PRE> <P>Both will produce multi-value fields for each type of port, which you can then process using the mv* commands.</P> Mon, 06 Jun 2016 17:21:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-these-2-fields-from-this/m-p/281897#M85079 richgalloway 2016-06-06T17:21:42Z