The following allows for student ids i.e. not strictly student1, student2 etc., and for names in Field2 being in a different order ... | rex max_match=0 field=Field1 "(?<prefix>[^:]*): (?<students>.*)" | eval student=split(students, ", ") | rex max_match=0 field=Field2 "((?<studentname>[^\:\{]*)\:\{first_name:(?<studentfirst>[^,]*),last_name:(?<studentlast>[^\}]*)\},?)" | eval studentfullname=mvzip(studentfirst,studentlast," ") | eval student=mvmap(student,mvindex(studentfullname,mvfind(studentname,student))) | eval students=mvjoin(student,", ") | eval expected=prefix.": ".students ... View more

https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Setuploadbalancingd This one is helpful ... View more

Hi @deepak_negi02, were you able to make this finally work ? I am facing this same issue. I have configured port 1515 udp on Splunk for esx syslog using the above method. ... View more