Splunk rex multiple duplicate match