Splunk Search

Need help with Regex

Path Finder

Requirement is to fetch values for all agentName and put it in a field.


Tried - 'agentName':\s(?<agentname>.*?,) but it pulls only first occurence. 

Below is sample:


0,1,"[{'active': 0, 'metricsAtStart': 'Jitter: 193.6 ms', 'metricsAtEnd': 'Jitter: 98.8 ms', 'agentId': 280961, 'agentName': 'BR15CORPTE01', 'dateStart': '2023-07-19 18:27:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=280961'}, {'active': 0, 'metricsAtStart': 'Jitter: 194.2 ms', 'metricsAtEnd': 'Jitter: 1.9 ms', 'agentId': 294526, 'agentName': 'US06CORPTE01', 'dateStart': '2023-07-19 18:23:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294526'}, {'active': 1, 'metricsAtStart': 'Jitter: 100.2 ms', 'metricsAtEnd': '', 'agentId': 294566, 'agentName': 'US22CORPTE01', 'dateStart': '2023-07-19 18:28:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=294566'}, {'active': 0, 'metricsAtStart': 'Latency: 209 ms', 'metricsAtEnd': 'Latency: 142.9 ms', 'agentId': 337436, 'agentName': 'AR06CORPTE01', 'dateStart': '2023-07-19 18:26:00', 'dateEnd': '2023-07-19 18:27:00', 'permalink': 'https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203&agentId=337436'}]",194913203,2023-07-19 18:22:00,"[{'rel': 'related', 'href': 'https://api.thousandeyes.com/v6/tests/3271565'}, {'rel': 'data', 'href': 'https://api.thousandeyes.com/v6/net/metrics/3271565'}]",https://app.thousandeyes.com/alerts/list/?__a=243206&alertId=194913203,((avgLatency >

Labels (1)
Tags (1)
0 Karma


Use max_match=0

| rex max_match=0 ...
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...