<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: how to use rex function  different different pattern of data in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442341#M6400</link>
    <description>&lt;P&gt;Quite right.  I have made more adjustments; see my updated answer which works for every file.&lt;/P&gt;</description>
    <pubDate>Sat, 16 Mar 2019 22:14:52 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2019-03-16T22:14:52Z</dc:date>
    <item>
      <title>how to use rex function  different different pattern of data</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442338#M6397</link>
      <description>&lt;P&gt;In my scenario data filename having different different of pattern :&lt;/P&gt;

&lt;P&gt;Sample filename data :&lt;BR /&gt;
File_Name     | Client_name (Output column)&lt;BR /&gt;
Weekly OB Unable to Reach Report-011919-012619-Absolute Total Care.xlsx  | &lt;STRONG&gt;Absolute Total Care&lt;/STRONG&gt;&lt;BR /&gt;
OB Incentive Report-December 2018-WellCare of Georgia.xlsx | &lt;STRONG&gt;WellCare of Georgia&lt;/STRONG&gt;&lt;BR /&gt;
Optum_WellCareNJ_Quarterly_AssessmentResponse_2018Q4.xlsx | &lt;STRONG&gt;Optum&lt;/STRONG&gt;&lt;BR /&gt;
WellCareSC Qrtrly_Visits_2018Q4.xlsx  | &lt;STRONG&gt;WellCareSC **&lt;BR /&gt;
TotalCare_Dashboard_201812_V1.pdf |&lt;/STRONG&gt;TotalCare**&lt;/P&gt;

&lt;P&gt;In Above data we have File_Name and Client name &lt;/P&gt;

&lt;P&gt;Idea is : To extract &lt;STRONG&gt;Client Name&lt;/STRONG&gt; from File name &lt;/P&gt;

&lt;P&gt;to do this I have Lookupfile where client names are stored &lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 23:42:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442338#M6397</guid>
      <dc:creator>shishirkumar</dc:creator>
      <dc:date>2020-09-29T23:42:56Z</dc:date>
    </item>
    <item>
      <title>Re: how to use rex function  different different pattern of data</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442339#M6398</link>
      <description>&lt;P&gt;Like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval File_Name="Weekly OB Unable to Reach Report-011919-012619-Absolute Total Care.xlsx|OB Incentive Report-December 2018-WellCare of Georgia.xlsx|Optum_WellCareNJ_Quarterly_AssessmentResponse_2018Q4.xlsx|WellCareSC Qrtrly_Visits_2018Q4.xlsx|TotalCare_Dashboard_201812_V1.pdf"
| makemv delim="|" File_Name
| mvexpand File_Name

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| eval hyphen_based = File_Name
| rex field=hyphen_based mode=sed "s/^.*-//"
| eval File_Name = if(File_Name != hyphen_based, hyphen_based, replace(File_Name, "[_ ].*$", ""))
| rex field=File_Name mode=sed "s/\.[^\.]+$//"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sat, 16 Mar 2019 21:04:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442339#M6398</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-03-16T21:04:03Z</dc:date>
    </item>
    <item>
      <title>Re: how to use rex function  different different pattern of data</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442340#M6399</link>
      <description>&lt;P&gt;This won't work as the sed part deletes all characters before and including the last dash. The line starting with "Optum" e.g. has no dash at all so the complete file_name is returned.&lt;/P&gt;

&lt;P&gt;I like the idea of using a lookup file to check the file_name against it - but the lookup command does only an exact string match. Is there some way to &lt;/P&gt;

&lt;P&gt;Expanding your way of creating test data I got the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval file_name="Weekly OB Unable to Reach Report-011919-012619-Absolute Total Care.xlsx|OB Incentive Report-December 2018-WellCare of Georgia.xlsx|Optum_WellCareNJ_Quarterly_AssessmentResponse_2018Q4.xlsx|WellCareSC Qrtrly_Visits_2018Q4.xlsx|TotalCare_Dashboard_201812_V1.pdf" 
| makemv delim="|" file_name 
| mvexpand file_name
| eval client_name="Absolute Total Care|WellCare of Georgia|Optum|WellCareSC|TotalCare"
| makemv delim="|" client_name
| mvexpand client_name
| where file_name like "%".client_name."%"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Maybe this could lead in the right direction.&lt;/P&gt;</description>
      <pubDate>Sat, 16 Mar 2019 21:57:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442340#M6399</guid>
      <dc:creator>rvany</dc:creator>
      <dc:date>2019-03-16T21:57:25Z</dc:date>
    </item>
    <item>
      <title>Re: how to use rex function  different different pattern of data</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442341#M6400</link>
      <description>&lt;P&gt;Quite right.  I have made more adjustments; see my updated answer which works for every file.&lt;/P&gt;</description>
      <pubDate>Sat, 16 Mar 2019 22:14:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/how-to-use-rex-function-different-different-pattern-of-data/m-p/442341#M6400</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-03-16T22:14:52Z</dc:date>
    </item>
  </channel>
</rss>

