Splunk Search

How to separate results from extraction with multiple similar fields with regex?

SMM10
Explorer

I am looking through our current alerts and we have a few evaluations that occur like below.

Total_Trade: 129
Total_Value: 300
Total_Amount: 1000

I have a rex like below:

 

 

 

| rex max_match=0 Total_(?<Type>\w+):(?<amount>\w+)

 

 

 


Doing this though I get two fields with multiple events like below.

Type amount
Trade
Value
Amount
129
300
1000

 

What I wanted was each of these to be separate though/

Type amount

Trade

129
Value 300
Amount 1000
   
Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "Total_(?<Typeamount>\w+:\s*\w+)"
| mvexpand Typeamount
| rex field=Typeamount "(?<Type>\w+):\s*(?<amount>\w+)"
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...