how to extract multiple values into one field

[utk123]

I have windows logs in below format, and not able to extract single field for merged text value.
I want to create a field named "Merged_text" from listed logs.

Sample:
Hostname = 1.1.1.1
Date time = 31.07/18 00:00:00
Merged text = user [abcd]: signed in on: signon pass on terminal '1.1.1.1' at 00:00:00 using 'Application name'.

Splunk extraction is not working, as Merged text got multiple strings.

[sumaitasiddiky1]

Hi, I have a list of Tenants and the data is being pulled from Jira labels.

Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.

There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.

There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.

At the moment the view is :

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

I want it like :

Tenant Count
PLATFORM 29

[thambisetty · Accepted solution]

Hi,

Below rex will create new field Merged_text and it captures until . (Full stop) After Application name.

Your base search
    | rex "Merged\stext\=(?<Merged_text>[^\.]+)"

[niketn]

@utk123 I am confused. Which is data in your question and what you need to extract? Also what have you tried that did not work?