Splunk Search

Regex: How to extract multiple fields with the same name?

olheiser01
New Member

Here is an example of the log I am dealing with:

<123 Main St>
<456 Center St.>

I'd like to simply extract the names and addresses as seen below, but I'm not sure how to deal with the fields having the same name for different people.

Sender Name    Sender Address     Receiver Name     Receiver Address
John Doe       123 Main St.       Jane Doe          456 Center St.
0 Karma

somesoni2
Revered Legend

Try like this

your base search | rex "\<send-customer\>\<full-name\>\<(?<SenderName>[^\>]+)\>\<\/full-name\>\<address\>\<(?<SenderAddress>[^\>]+)\>\<\/address\>\<\/send-customer\>"  | rex "\<receive-customer\>\<full-name\>\<(?<ReceiverName>[^\>]+)\>\<\/full-name\>\<address\>\<(?<ReceiverAddress>[^\>]+)\>\<\/address\>\<\/receive-customer\>"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think we need more information. Your sample log has only an address so how is it identified as Sender Address or Receiver Address? Where do the names come from?

---
If this reply helps you, Karma would be appreciated.
0 Karma

olheiser01
New Member

There was definitely a typo some where. Here is what I meant to ask:

Here is an example of the log I am dealing with:

<send-customer><full-name><John Doe></full-name><address><123 Main St></address></send-customer>
<receive-customer><full-name><Jane Doe></full-name><address><456 Center St.></address></receive-customer>

I'd like to simply extract the names and addresses as seen below but Im not sure how to deal with the fields having the same name for different people.

**Sender Name    Sender Address        Receiver Name     Receiver Address**
John Doe           123 Main St.               Jane Doe                456 Center St.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The spath command will create fields with different names: send-customer.address, receive-customer.address, etc. However, spath doesn't work with your data since the values look like tags with angle brackets around them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...