How to search field output?

[David_M]

I am VERY new to splunk so please bear with me.  I have a search,

index=vulnerability "list of packages installed on the remote" myserver.com | rex field=output "\n{1,3}\s{2,4}(?<ProgramNameOutput>[^|]+)" max_match=5000 | table ProgramNameOutput

Which produces the following fictional output:

libhangul-0.1.0-8.el7

intltool-0.50.2-7.el7

libvert-7.6.1-120.el7

at-spi2-core-2.28.0-1.el7

spice-gtk3-0.35-5.el7_9.1

perl-Digest-MD5-2.52-3.el7

mesa-libvert-18.3.4-12.el7_9

hyperv-daemons-license-0-0.34.20180415git.el7

libsysfs-2.1.0-16.el7

openldap-clients-2.4.44-25.el7_9

libvirt-gconfig-1.0.0-1.el7

libpeas-gtk-1.22.0-1.el7

NetworkManager-adsl-1.18.8-2.el7_9

perl-Locale-Maketext-1.23-3.el7

So what I'd like to do is to pair that ProgramNameOutput down to only output that has "libvert" in it.

The output field looks similar to this, it's basically one big text block:

"output: 

Here is the list of packages installed on the remote CentOS Linux system :

libhangul-0.1.0-8.el7|(none) Mon 01 Nov 2021 12:06:47 PM EDT

intltool-0.50.2-7.el7|(none) Mon 01 Nov 2021 12:10:13 PM EDT

gdb-7.6.1-120.el7|(none) Mon 01 Nov 2021 12:06:15 PM EDT

at-spi2-core-2.28.0-1.el7|(none) Mon 01 Nov 2021 12:08:53 PM EDT

spice-gtk3-0.35-5.el7_9.1|(none) Mon 01 Nov 2021 12:40:05 PM EDT

perl-Digest-MD5-2.52-3.el7|(none) Mon 01 Nov 2021 12:05:15 PM EDT

mesa-filesystem-18.3.4-12.el7_9|(none) Mon 01 Nov 2021 12:38:01 PM EDT"

[richgalloway · Accepted solution]

See if the mvfilter function helps.

index=vulnerability "list of packages installed on the remote" myserver.com 
| rex field=output "\n{1,3}\s{2,4}(?<ProgramNameOutput>[^|]+)" max_match=5000 
| eval ProgramNameOutput = mvfilter(match(ProgramNameOutput, "libvirt"))
| table ProgramNameOutput

[David_M]

Well that did the trick Rich!  Thank you...