Splunk Search

How to extract multiple values to same field?

CybSec1
New Member

Hello,

I have logs like : 

samples={'xxxxxxx' : {'111' :{'222' :{'333'}}}}{'yyyyyyy'{'444'}}{'zzzzzzz'}

I need to take all words to one field like ;  my field : 'xxxxxxx','yyyyyyy','zzzzzzz'

Thank you,

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/[^[:alpha:]']+//g s/''/','/g s/'',//g"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @CybSec1 ,

your log seems to be a json file, have you tried with the spath command?

it extract all fields from json files.

For more information see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath 

then you can use your values in your searches.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...