Splunk Search

What will be the Regex for the below?

abhi04
Communicator

How to capture all the below in one variable using Regex. Below is the sample. Each line is a separate value and in a separate event.

pkg://solaris/x11/session/xauth@1.0.7,5.11-0.175.3.0.0.30.1483:20150821T173742Z
pkg://solaris/x11/library/toolkit/libxt@1.1.4,5.11-0.175.3.0.0.30.1483:20150821T173635Z
pkg://solaris/x11/library/toolkit/libxaw7@1.0.12,5.11-0.175.3.0.0.30.1483:20150821T173633Z
pkg://solaris/x11/library/libxtst@1.2.2,5.11-0.175.3.15.0.3.1517:20161130T212037Z
pkg://solaris/x11/library/libxscrnsaver@1.2.2,5.11-0.175.3.0.0.30.1483:20150821T173612Z
pkg://solaris/x11/library/libxrender@0.9.8,5.11-0.175.3.15.0.3.1517:20161130T212036Z
pkg://solaris/x11/library/libxrandr@1.4.2,5.11-0.175.3.15.0.3.1517:20161130T212035Z
pkg://solaris/x11/library/libxpm@3.5.11,5.11-0.175.3.20.0.2.1526:20170422T003808Z
pkg://solaris/x11/library/libxmuu@1.1.2,5.11-0.175.3.0.0.30.1483:20150821T173604Z
pkg://solaris/x11/library/libxmu@1.1.2,5.11-0.175.3.0.0.30.1483:20150821T173603Z
pkg://solaris/x11/library/libxinerama@1.1.3,5.11-0.175.3.0.0.30.1483:20150821T173600Z
pkg://solaris/x11/library/libxi@1.7.2,5.11-0.175.3.20.0.2.1526:20170422T003806Z
pkg://solaris/x11/library/libxft@2.3.1,5.11-0.175.3.0.0.30.1483:20150821T173557Z
pkg://solaris/x11/library/libxfixes@5.0.1,5.11-0.175.3.15.0.3.1517:20161130T212031Z
pkg://solaris/x11/library/libxext@1.3.2,5.11-0.175.3.0.0.30.1483:20150821T173553Z
pkg://solaris/x11/library/libxevie@1.0.3,5.11-0.175.3.0.0.30.1483:20150821T173552Z
pkg://solaris/x11/library/libxdmcp@1.1.1,5.11-0.175.3.0.0.30.1483:20150821T173550Z
pkg://solaris/x11/library/libxdamage@1.1.4,5.11-0.175.3.0.0.30.1483:20150821T173549Z
pkg://solaris/x11/library/libxcursor@1.1.14,5.11-0.175.3.0.0.30.1483:20150821T173548Z
pkg://solaris/x11/library/libxcomposite@0.4.4,5.11-0.175.3.0.0.30.1483:20150821T173547Z
pkg://solaris/x11/library/libxcb@1.9.1,5.11-0.175.3.20.0.3.1528:20170501T144906Z
pkg://solaris/x11/library/libxau@1.0.8,5.11-0.175.3.0.0.30.1483:20150821T173540Z
pkg://solaris/x11/library/libx11@1.6.2,5.11-0.175.3.20.0.3.1528:20170501T144852Z
pkg://solaris/x11/library/libsm@1.2.2,5.11-0.175.3.0.0.30.1483:20150821T173530Z
pkg://solaris/x11/library/libpthread-stubs@0.3,5.11-0.175.3.0.0.30.1483:20150821T173529Z
pkg://solaris/x11/library/libice@1.0.8,5.11-0.175.3.0.0.30.1483:20150821T173527Z
pkg://solaris/x11/library/libfontenc@1.1.2,5.11-0.175.3.0.0.30.1483:20150821T173524Z
pkg://solaris/x11/library/libdga@0.5.11,5.11-0.175.3.0.0.30.1483:20150821T173520Z
pkg://solaris/x11/header/x11-protocols@7.7,5.11-0.175.3.2.0.2.1493:20151020T015530Z
pkg://solaris/x11/compatibility/links-xorg@0.5.11,5.11-0.175.3.0.0.30.1483:20150821T173454Z
pkg://solaris/web/wget@1.19.2,5.11-0.175.3.27.0.2.0:20171117T180437Z
pkg://solaris/web/server/apache-22/module/apache-wsgi-27@4.3.0,5.11-0.175.3.20.0.1.0:20170412T191300Z
pkg://solaris/web/server/apache-22@2.2.34,5.11-0.175.3.24.0.2.0:20170823T230737Z
pkg://solaris/web/curl@7.45.0,5.11-0.175.3.21.0.4.0:20170605T171703Z
pkg://solaris/text/texinfo@4.13,5.11-0.175.3.0.0.30.0:20150821T172732Z
pkg://solaris/text/spelling-utilities@0.5.11,5.11-0.175.3.0.0.30.0:20150821T160103Z
pkg://solaris/text/less@458,5.11-0.175.3.0.0.30.0:20150821T172730Z
pkg://solaris/text/groff/groff-core@1.22.2,5.11-0.175.3.0.0.30.0:20150821T172720Z
pkg://solaris/text/groff@1.22.2,5.11-0.175.3.0.0.30.0:20150821T172725Z
pkg://solaris/text/gnu-sed@4.2.1,5.11-0.175.3.0.0.30.0:20150821T172718Z
pkg://solaris/text/gnu-patch@2.7.5,5.11-0.175.3.0.0.30.0:20150821T172717Z
pkg://solaris/text/gnu-grep@2.14,5.11-0.175.3.0.0.30.0:20150821T172715Z
pkg://solaris/text/gnu-gettext@0.16.1,5.11-0.175.3.0.0.30.0:20150821T172707Z
pkg://solaris/text/gnu-diffutils@2.8.7,5.11-0.175.3.0.0.30.0:20150821T172706Z
pkg://solaris/text/gawk@3.1.8,5.11-0.175.3.0.0.30.0:20150821T172704Z
pkg://solaris/text/doctools/ja@0.5.11,5.11-0.175.3.0.0.26.2:20150705T210812Z
pkg://solaris/text/doctools@0.5.11,5.11-0.175.3.20.0.3.0:20170501T142927Z
pkg://solaris/terminal/screen@4.0.3,5.11-0.175.3.0.0.30.0:20150821T172658Z
pkg://solaris/terminal/resize@0.320,5.11-0.175.3.12.0.2.1514:20160819T191023Z
pkg://solaris/terminal/luit@1.1.1,5.11-0.175.3.12.0.2.1514:20160819T191022Z
pkg://solaris/system/zones/brand/brand-solaris@0.5.11,5.11-0.175.3.8.0.2.0:20160418T185451Z
pkg://solaris/system/zones@0.5.11,5.11-0.175.3.26.0.1.0:20171009T204948Z
pkg://solaris/system/xopen/xcu6@0.5.11,5.11-0.175.3.20.0.1.0:20170412T185428Z
pkg://solaris/system/xopen/xcu4@0.5.11,5.11-0.175.3.20.0.1.0:20170412T185425Z
pkg://solaris/system/system-events@0.5.11,5.11-0.175.3.0.0.30.0:20150821T160010Z
pkg://solaris/system/storage/removable-media@0.5.11,5.11-0.175.3.0.0.30.0:20150821T155959Z
pkg://solaris/system/storage/media-volume-manager@0.5.11,5.11-0.175.3.21.0.3.0:20170526T014215Z
pkg://solaris/system/storage/iscsi/iscsi-initiator@0.5.11,5.11-0.175.3.27.0.2.0:20171117T180011Z
pkg://solaris/system/rsyslog@8.4.2,5.11-0.175.3.21.0.4.0:20170605T171657Z
pkg://solaris/system/resource-mgmt/resource-pools@0.5.11,5.11-0.175.3.20.0.3.0:20170501T142834Z
pkg://solaris/system/resource-mgmt/resource-caps@0.5.11,5.11-0.175.3.21.0.1.0:20170518T224721Z
pkg://solaris/system/prerequisite/gnu@0.5.11,5.11-0.175.3.0.0.30.0:20150821T172645Z
pkg://solaris/system/network/routing@0.5.11,5.11-0.175.3.25.0.1.0:20170916T013747Z
pkg://solaris/system/network/ppp/pppdump@0.5.11,5.11-0.175.3.0.0.30.0:20150821T155912Z
pkg://solaris/system/network/nis@0.5.11,5.11-0.175.3.27.0.3.0:20171127T194400Z
pkg://solaris/system/network/ike@0.5.11,5.11-0.175.3.24.0.1.0:20170811T213930Z
pkg://solaris/system/network/bpf@0.5.11,5.11-0.175.3.11.0.2.0:20160721T145007Z
pkg://solaris/system/network@0.5.11,5.11-0.175.3.26.0.4.0:20171027T193315Z
pkg://solaris/system/manual/locale@0.5.11,5.11-0.175.3.0.0.26.2:20150705T210800Z
pkg://solaris/system/manual@0.5.11,5.11-0.175.3.0.0.28.0:20150802T213531Z
pkg://solaris/system/management/snmp/net-snmp/documentation@5.4.1,5.11-0.175.3.26.0.3.0:20171020T001341Z
pkg://solaris/system/management/snmp/net-snmp/addons@5.4.1,5.11-0.175.3.26.0.3.0:20171020T001339Z
pkg://solaris/system/management/snmp/net-snmp@5.4.1,5.11-0.175.3.26.0.3.0:20171020T001344Z
pkg://solaris/system/management/rad/module/rad-zonemgr@0.5.11,5.11-0.175.3.23.0.1.0:20170712T212308Z
pkg://solaris/system/management/rad/module/rad-zfsmgr@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191518Z
pkg://solaris/system/management/rad/module/rad-usermgr@0.5.11,5.11-0.175.3.17.0.4.0:20170207T190433Z
pkg://solaris/system/management/rad/module/rad-time@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191515Z
pkg://solaris/system/management/rad/module/rad-smf@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191514Z
pkg://solaris/system/management/rad/module/rad-panels@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191512Z
pkg://solaris/system/management/rad/module/rad-network@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191511Z
pkg://solaris/system/management/rad/module/rad-kstat@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191510Z
pkg://solaris/system/management/rad/module/rad-files@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191509Z
pkg://solaris/system/management/rad/module/rad-dlmgr@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191506Z
pkg://solaris/system/management/rad/client/rad-python@0.5.11,5.11-0.175.3.17.0.1.0:20170117T191504Z
pkg://solaris/system/management/rad/client/rad-c@0.5.11,5.11-0.175.3.21.0.3.0:20170526T014156Z
pkg://solaris/system/management/rad@0.5.11,5.11-0.175.3.26.0.1.0:20171009T204930Z
pkg://solaris/system/locale/setterm@0.5.11,5.11-0.175.3.0.0.26.2:20150705T205114Z
pkg://solaris/system/locale/nls-administration@0.5.11,5.11-0.175.3.14.0.4.4:20161028T180554Z
pkg://solaris/system/locale/extra@0.5.11,5.11-0.175.3.5.0.1.2:20160111T235719Z
pkg://solaris/system/locale@0.5.11,5.11-0.175.3.5.0.1.2:20160111T235852Z
pkg://solaris/system/linker@0.5.11,5.11-0.175.3.26.0.4.0:20171027T193305Z
pkg://solaris/system/library/usb/libusbugen@0.5.11,5.11-0.175.3.0.0.30.0:20150821T172553Z
pkg://solaris/system/library/usb/libusb@0.5.11,5.11-0.175.3.0.0.30.0:20150821T172552Z
pkg://solaris/system/library/storage/suri@0.5.11,5.11-0.175.3.27.0.1.0:20171114T161717Z
pkg://solaris/system/library/storage/snia-ima@0.5.11,5.11-0.175.3.13.0.3.0:20160926T222129Z
pkg://solaris/system/library/storage/snia-hbaapi@0.5.11,5.11-0.175.3.21.0.1.0:20170518T224514Z
pkg://solaris/system/library/storage/scsi-plugins@0.5.11,5.11-0.175.3.0.0.30.0:20150821T155624Z
pkg://solaris/system/library/storage/libdiskmgt@0.5.11,5.11-0.175.3.23.0.1.0:20170712T212143Z
pkg://solaris/system/library/security/rpcsec@0.5.11,5.11-0.175.3.21.0.3.0:20170526T014013Z
pkg://solaris/system/library/security/pkcs11_tpm@0.5.11,5.11-0.175.3.18.0.2.0:20170223T014908Z

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use | stats values(fieldname) as fieldname OR | stats list(fieldname) as fieldname to merge multiple events into one event/field names. Could you explain more about your requirement here?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You don't need regex to get the whole line in one variable - it's already in _raw.

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhi04
Communicator

@richgalloway, each line is a part of a different events. So the _raw wont show these,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Regex cannot combine events.
Like somesoni2 said, the stats command can combine events to a degree. It would be helpful to know more about your use case/requirements, however.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...