How to write a Regex to search globally?

[onthakur]

below is the data which has multiple features for a single item. I want to write a regex which could search all occurrences of feature (not just first occurance) and then count the feature . I have written below search string but count value is not consistent. can someone plz take a look and advice.

Many thanks in advance.

|makeresults
| eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"},
{\"\"feature\"\": \"\"INTDATA2\"\"},
{\"\"feature\"\": \"\"MGDAT0\"\"},
{\"\"feature\"\": \"\"MGPR2TI\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"PNINCLWAP\"\"},
{\"\"feature\"\": \"\"PRMCAFIND\"\"},
{\"\"feature\"\": \"\"3WY\"\"},
{\"\"feature\"\": \"\"CFC\"\"},
{\"\"feature\"\": \"\"CFU\"\"},
{\"\"feature\"\": \"\"CLIP\"\"},
{\"\"feature\"\": \"\"CLIR\"\"},
{\"\"feature\"\": \"\"CLW\"\"},
{\"\"feature\"\": \"\"DATA\"\"},
{\"\"feature\"\": \"\"CAMTAC\"\"},
{\"\"feature\"\": \"\"HOLD\"\"},
{\"\"feature\"\": \"\"INROAM\"\"},
{\"\"feature\"\": \"\"ISP\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"NWROAM\"\"},
{\"\"feature\"\": \"\"PERMGL\"\"},
{\"\"feature\"\": \"\"SMSO\"\"},
{\"\"feature\"\": \"\"VM\"\"},
{\"\"feature\"\": \"\"GFLEX\"\"}]"
|rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}"
|stats count(feature) by feature

[somesoni2]

Try like this

|makeresults
| eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"},
{\"\"feature\"\": \"\"INTDATA2\"\"},
{\"\"feature\"\": \"\"MGDAT0\"\"},
{\"\"feature\"\": \"\"MGPR2TI\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"PNINCLWAP\"\"},
{\"\"feature\"\": \"\"PRMCAFIND\"\"},
{\"\"feature\"\": \"\"3WY\"\"},
{\"\"feature\"\": \"\"CFC\"\"},
{\"\"feature\"\": \"\"CFU\"\"},
{\"\"feature\"\": \"\"CLIP\"\"},
{\"\"feature\"\": \"\"CLIR\"\"},
{\"\"feature\"\": \"\"CLW\"\"},
{\"\"feature\"\": \"\"DATA\"\"},
{\"\"feature\"\": \"\"CAMTAC\"\"},
{\"\"feature\"\": \"\"HOLD\"\"},
{\"\"feature\"\": \"\"INROAM\"\"},
{\"\"feature\"\": \"\"ISP\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"NWROAM\"\"},
{\"\"feature\"\": \"\"PERMGL\"\"},
{\"\"feature\"\": \"\"SMSO\"\"},
{\"\"feature\"\": \"\"VM\"\"},
{\"\"feature\"\": \"\"GFLEX\"\"}]"
|rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}"| mvexpand feature
|stats count(feature) by feature

[onthakur]

thank you that works.