Splunk Search

field extraction from some multivalued fields seperated by comma

christythomas
Explorer

Log event x: This is the name of the group#2 target(s) [name3]
Log event y: This is the name of the group#1 target(s) [name1,name2]

just omitted other parts of log including time-stamp.
how to extract all the names to one field "members" to produce a table group , members
not able to extract the second field, i a not good in regular expressions and couldn't find a way..
Any help will be appreciated

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Two steps: First, extract the stuff between the brackets. Second, do a repeated match on the parts separated by commas:

... | rex "\[(?<members>[^\]]+)\]" | rex field=members max_match=0 "(?<members>[^,]+)"

Lowell
Super Champion

Don't forget about the simplicity of the mighty eval command:

... | rex "\[(?<members>[^\]]+)\]" | eval members=split(members, ",")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...