Splunk Search

how to search multiple patterns in named group

abhayneilam
Contributor

I am using the following command to search :

index="real" | rex field="Location" (?mumbai)

can anyone tell me how do i search multiple value like : here m searching for "mumbai" but if I would also like to search for "delhi" and "kol" then what i have to write ...

Please help me !!

Thanks
Abhay

Tags (5)
0 Karma

MarioM
Motivator

wouldn't it be easier to do ?

index="real" Location="*mumbai*"

index="real" Location="*delhi*"

index="real" Location="*kol*"

OR if you dont have many values

index="real" | rex field="Location" (?<target>(mumbai|delhi|kol)) | search target=mumbai
0 Karma

abhayneilam
Contributor

but my output should come like this :

Name,age,company,target
xyz,45,kolkata,kolkata
xyz,45,kolkata is a mumbai,kolkata mumbai
xyz,45,ludhiaya
xyz,45,delhi, delhi

xyz,45,bangalore

"target" will be added as a last column and the matched keywords will be the value

Please help

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...