Splunk field extraction issue

[manish007g]

I want to extract a field event_id from the below log with all values being captured by this field name.

The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]

Could some help me extract the field.

[s2_splunk · Accepted solution]

Assuming your single event contains the data you show above verbatim, i.e.

The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]

try this:

<yoursearch to find data> | rex max_match=0 "id=(?<event_id>\d+),"

This should give you a multi-value field called event_id which contains a list of all ids in the event. You can then do whatever you need to do with that.