Splunk Search

How to capture all "Names" from a single event?

Android99
Engager

Hi,

Hypothetically speaking, if I have the following event:

 

q[pworei[qpweori[pqwoeirp[qowier[powierw"NAME":"BOB";POQIWERUPQOWIEUPROIQWEURPOWIERPOWQIUR"NAME":"SAM";qpweoirpwoierupwoiproiqproiw"NAME":"COLT";

I want to have a table with a column title Name, and then have all names included in that row. Preferably in this format: BOB, SAM, COLT. Is this possible?

The problem I run into is when I do:

| rex field=_raw \"NAME\"\:\"(?<Name>\W+)\"

It only captures the first Name. Is there anything I can do where it captures all of the names?

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this to override default match limit of 1.  This will give you a multivalued field 'Name'. 

| rex max_match=0 field=_raw \"NAME\"\:\"(?<Name>\W+)\"

 

You can further use command "| nomv Name" to make it a single valued field.

View solution in original post

somesoni2
Revered Legend

Try like this to override default match limit of 1.  This will give you a multivalued field 'Name'. 

| rex max_match=0 field=_raw \"NAME\"\:\"(?<Name>\W+)\"

 

You can further use command "| nomv Name" to make it a single valued field.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...