Hi there,
I am a newbie in Splunk and trying to do some search using the rex.
The log body is like:
blah blah
Dest : aaa
blah blah
Dest: bbb
blah blah
Dest: ccc
I searched online and used some command like ' rex field=_raw "(?s)Dest : (?.*)" ' or (?smi), but it wasn't what I wanted.
I need the output to only get the table like
aaa
bbb
ccc
Is there any way to do that?
Thank you very much in advance!
:)
Like this:
| rex max_match=0 "(?ms)\s+Dest:\s+(?<Dest>\S+)"
| stats values(Dest) AS Dests
To get it into a table on its own it would be:
| rex "Dest:\s+(?<Data>.*)"
| table Data
Try this:
| rex field=_raw "Dest\s*:\s(?P<myfield>.*)"
Like this:
| rex max_match=0 "(?ms)\s+Dest:\s+(?<Dest>\S+)"
| stats values(Dest) AS Dests
+1 i misinterpretted. max_match=0 would get multiple results
Thanks woodcock, I used "| rex max_match=0 field=_raw "(?)Dest : (?.*)" | table path" in the end, but your suggestion to use "max_match=0" really helps!
That is the whole point, is it not?