- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![jacqu3sy jacqu3sy](https://community.splunk.com/legacyfs/online/avatars/465291.jpg)
Hi,
I need a Regex to use within the search query to pick up individual values separated by comma's within a set of speech marks. The number of values varies, but is started and broken by those speech marks.
For example within the _raw I have;
db_values="value1, value2, value3, value4"
I tried the following but not sure how I separate out value 1 and value 2 etc into separate entities;
rex field=db_value"(?P\w+_\w+)-"
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi jacqu3sy,
I'm not sure to have understood your need.
if you want to extract in separate events all the values in db_value you could use something like this
your_regex
| makemv db_values delim=","
| mvexpand db_values
| table db_values
Splunk automatically extract db_values field, if you want it's possible to extract using a regex:
your_regex
| rex max_match=0 "db_values="(?<db_values>[^,]*)"
| makemv db_values delim=","
| mvexpand db_values
| table db_values
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Hi jacqu3sy,
I'm not sure to have understood your need.
if you want to extract in separate events all the values in db_value you could use something like this
your_regex
| makemv db_values delim=","
| mvexpand db_values
| table db_values
Splunk automatically extract db_values field, if you want it's possible to extract using a regex:
your_regex
| rex max_match=0 "db_values="(?<db_values>[^,]*)"
| makemv db_values delim=","
| mvexpand db_values
| table db_values
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![jacqu3sy jacqu3sy](https://community.splunk.com/legacyfs/online/avatars/465291.jpg)
Awesome. The second one worked perfectly. thanks.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)