How to extract multiple values to same field?

[CybSec1]

Hello,

I have logs like : 

samples={'xxxxxxx' : {'111' :{'222' :{'333'}}}}{'yyyyyyy'{'444'}}{'zzzzzzz'}

I need to take all words to one field like ;  my field : 'xxxxxxx','yyyyyyy','zzzzzzz'

Thank you,

[ITWhisperer]

| rex mode=sed "s/[^[:alpha:]']+//g s/''/','/g s/'',//g"

[gcusello]

Hi @CybSec1 ,

your log seems to be a json file, have you tried with the spath command?

it extract all fields from json files.

For more information see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath 

then you can use your values in your searches.

Ciao.

Giuseppe