Splunk Search

How to extract repeated field values in same event?

rajs115
Path Finder
Hi Guys, I am new to splunk. I need to run a query to extract the system name value which is repeated twice in the same log event. Logs in one event are: user: user1 system: system1 user:user2 system: system2 output should look like below: output1 output2 system1 system2 cheers.
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=2 "system:\s(?<system>[\S]+)"
| eval system1=mvindex(system,0)
| eval system2=mvindex(system,1)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=2 "system:\s(?<system>[\S]+)"
| eval system1=mvindex(system,0)
| eval system2=mvindex(system,1)

rajs115
Path Finder

@ITWhisperer ,

 

Logs in one event are:

user: user1

system: system1

 

user:user2

system: system2

 

output should look like below:

output1      output2

system1     system2

 

I tried as you suggested. Not returning any values.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the raw events in a code block </>

0 Karma

rajs115
Path Finder

@ITWhisperer ,

  Its working now. Made a slight change from your command. Not sure it its appropriate or not. is there any way we can compare these two values  or same or not (if system1=system2) 

 

| rex max_match=2 "system:\s(?<system>[\S]+)"
| eval system1=mvindex(system,-1)
| eval system2=mvindex(system,0)

 

0 Karma

rajs115
Path Finder
Logs in one event are: user: user1 system: system1 user:user2 system: system2 output should look like below: output1 output2 system1 system2
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...