Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- multivalue field extraction
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-12-2018 23:41:12.856 +0000 INFO eod-hhh=5 eod-kkk=7 eod-lllll=88 eod-kaskas=898
01-12-2018 23:41:12.773 +0000 INFO eod-hhh=11 eod-kkk=44 eod-lllll=213123 eod-kaskas=2122 eod-llass=99
I have logs like the above. I want all values after eod- to grouped into one field.
01-12-2018 23:41:12.856 +0000 INFO eod-hhh=5 eod-kkk=7 eod-lllll=88 eod-kaskas=898
i should get hhh kkk llll kaskas as one value
01-12-2018 23:41:12.773 +0000 INFO eod-hhh=11 eod-kkk=44 eod-lllll=213123 eod-kaskas=2122 eod-llass=99
i should get hhh kkk llll kaskas llass as one value
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nawazns5038, try the following rex command:
| rex "eod-(?<eod>[^\=]+)\=" max_match=0
Following is the run anywhere example for the sample data provided:
| makeresults
| eval _raw="01-12-2018 23:41:12.856 +0000 INFO eod-hhh=5 eod-kkk=7 eod-lllll=88 eod-kaskas=898"
| append [| makeresults
| eval _raw="01-12-2018 23:41:12.773 +0000 INFO eod-hhh=11 eod-kkk=44 eod-lllll=213123 eod-kaskas=2122 eod-llass=99"]
| rex "eod-(?<eod>[^\=]+)\=" max_match=0
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nawazns5038, try the following rex command:
| rex "eod-(?<eod>[^\=]+)\=" max_match=0
Following is the run anywhere example for the sample data provided:
| makeresults
| eval _raw="01-12-2018 23:41:12.856 +0000 INFO eod-hhh=5 eod-kkk=7 eod-lllll=88 eod-kaskas=898"
| append [| makeresults
| eval _raw="01-12-2018 23:41:12.773 +0000 INFO eod-hhh=11 eod-kkk=44 eod-lllll=213123 eod-kaskas=2122 eod-llass=99"]
| rex "eod-(?<eod>[^\=]+)\=" max_match=0
| makeresults | eval message= "Happy Splunking!!!"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
