Splunk Search

field extraction from some multivalued fields seperated by comma

christythomas
Explorer

Log event x: This is the name of the group#2 target(s) [name3]
Log event y: This is the name of the group#1 target(s) [name1,name2]

just omitted other parts of log including time-stamp.
how to extract all the names to one field "members" to produce a table group , members
not able to extract the second field, i a not good in regular expressions and couldn't find a way..
Any help will be appreciated

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Two steps: First, extract the stuff between the brackets. Second, do a repeated match on the parts separated by commas:

... | rex "\[(?<members>[^\]]+)\]" | rex field=members max_match=0 "(?<members>[^,]+)"

Lowell
Super Champion

Don't forget about the simplicity of the mighty eval command:

... | rex "\[(?<members>[^\]]+)\]" | eval members=split(members, ",")
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...