how to extract multiple strings from multiple lines into 1 field

[mikegdlw]

I have a logline that is extracted in multiple fields already. 1 of those fields contain multiple strings on different lines.
I would like to extract certain strings from these lines, and add them to a single field.

example log:

source=10.0.0.1
destination=10.0.0.2
action=deny
extra=rule number 1
xlated_source:192.168.0.1
xlated_destination:10.0.0.2
source_info:the source is part of group /source/network/LAN
source_info:the source is part of group /source/network/LAN-Tulsa
source_info:the source is part of group /source/network/LAN-printers
dest_info:the destination is part of group /destination/network/LAN
dest_info:the destination is part of group /destination/network/LAN-DC

as a result I would like to have the following new fields extracted from the "extra" field:
network-srcinfo=LAN,LAN-Tulsa,LAN-printers
network-dstinfo=LAN,LAN-DC

when I do a:

| rex field=_raw "/source/network/(?\.*)"

I only get:

network-srcinfo=LAN

I'm quite new to splunk, and I can't seem to find an answer to this.

[MuS · Accepted solution]

Try something like this:

| rex max_match=0 field=_raw "\/source\/network\/(?<network-srcinfo>.*)" | table network-srcinfo

[mikegdlw]

Thank you! that fixed my issue.

Of course, now a new one popped up. It seems that within the logs, things are not as consistent as I thought.
so it can indeed show up as:
source_info:the source is part of group /source/network/LAN
source_info:the source is part of group /source/network/LAN-Tulsa
source_info:the source is part of group /source/network/LAN-printers

but also in other combinations:
source_info:the source is part of group /source/network/LAN-Tulsa
source_info:the source is part of group /source/network/LAN
source_info:the source is part of group /source/network/LAN-printers

is there a way to do an alphabetical sort within the network-srcinfo field?
otherwise the results would be that "LAN, LAN-Tulsa, LAN-printers" is seen as different than "LAN-Tulsa, LAN, LAN-printers" while in essence, this is not the case

[MuS]

add a | sort network-srcinfo at the end