Splunk Search

Need help with Regex

sbhatnagar88
Path Finder

Requirement is to fetch values for all agentName and put it in a field.

 

Tried - 'agentName':\s(?<agentname>.*?,) but it pulls only first occurence. 

Below is sample:

 

0,1,"[{'active': 0, 'metricsAtStart': 'Jitter: 193.6 ms', 'metricsAtEnd': 'Jitter: 98.8 ms', 'agentId': 280961, 'agentName': 'BR15CORPTE01', 'dateStart': '2023-07-19 18:27:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=280961'}, {'active': 0, 'metricsAtStart': 'Jitter: 194.2 ms', 'metricsAtEnd': 'Jitter: 1.9 ms', 'agentId': 294526, 'agentName': 'US06CORPTE01', 'dateStart': '2023-07-19 18:23:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294526'}, {'active': 1, 'metricsAtStart': 'Jitter: 100.2 ms', 'metricsAtEnd': '', 'agentId': 294566, 'agentName': 'US22CORPTE01', 'dateStart': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294566'}, {'active': 0, 'metricsAtStart': 'Latency: 209 ms', 'metricsAtEnd': 'Latency: 142.9 ms', 'agentId': 337436, 'agentName': 'AR06CORPTE01', 'dateStart': '2023-07-19 18:26:00', 'dateEnd': '2023-07-19 18:27:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=337436'}]",194913203,2023-07-19 18:22:00,"[{'rel': 'related', 'href': 'https://api.thousandeyes.com/v6/tests/3271565'}, {'rel': 'data', 'href': 'https://api.thousandeyes.com/v6/net/metrics/3271565'}]",https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203,((avgLatency >

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use max_match=0

| rex max_match=0 ...
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...