I may have a regex for something like rex field=sigNames "(?P<sigName>[^\x2c]+)"
This returns multiple matches within a single field... each instance of value up until a comma.
But Splunk just matches the first capture and calls it a day. When I use a rex on that field, I get something like:
How do I extract multiple values from one field with an unknown amount of value instances using a regex?
(could have a single value with no comma following, or could have 5 values with a comma between each)