Splunk Search

How to capture all "Names" from a single event?

Android99
Engager

Hi,

Hypothetically speaking, if I have the following event:

 

q[pworei[qpweori[pqwoeirp[qowier[powierw"NAME":"BOB";POQIWERUPQOWIEUPROIQWEURPOWIERPOWQIUR"NAME":"SAM";qpweoirpwoierupwoiproiqproiw"NAME":"COLT";

I want to have a table with a column title Name, and then have all names included in that row. Preferably in this format: BOB, SAM, COLT. Is this possible?

The problem I run into is when I do:

| rex field=_raw \"NAME\"\:\"(?<Name>\W+)\"

It only captures the first Name. Is there anything I can do where it captures all of the names?

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this to override default match limit of 1.  This will give you a multivalued field 'Name'. 

| rex max_match=0 field=_raw \"NAME\"\:\"(?<Name>\W+)\"

 

You can further use command "| nomv Name" to make it a single valued field.

View solution in original post

somesoni2
Revered Legend

Try like this to override default match limit of 1.  This will give you a multivalued field 'Name'. 

| rex max_match=0 field=_raw \"NAME\"\:\"(?<Name>\W+)\"

 

You can further use command "| nomv Name" to make it a single valued field.

Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...