topic Re: How to use regex on field names? in Splunk Search

How to use regex on field names?

tamakg — Tue, 11 Sep 2018 18:53:45 GMT

For example.

Is there any way to convert this:

into this?

Don't care about the numbers but the value of the second column (new) is a substr of the previous headers. Of course there are many other different "Disks".

Re: How to use regex on field names?

jodyfsu — Tue, 11 Sep 2018 19:34:48 GMT

If you can provide a sample event we can probably figure this out.

Re: How to use regex on field names?

tamakg — Tue, 11 Sep 2018 20:03:59 GMT

Here is the sample: https://1drv.ms/u/s!AsmV0Jvla5SrgW-CydStfrht3ep6

Re: How to use regex on field names?

jodyfsu — Tue, 11 Sep 2018 20:24:58 GMT

| rex field=PhysicalDisk_0_C_Avg__Disk_Bytes_Read "(?<DRIVE>\w+\_\d\_\w)\_(?<AVDBR>.[^\s]+)"

Re: How to use regex on field names?

jodyfsu — Tue, 11 Sep 2018 20:25:13 GMT

See if that works.

Re: How to use regex on field names?

somesoni2 — Tue, 11 Sep 2018 20:25:57 GMT

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

Re: How to use regex on field names?

tamakg — Tue, 11 Sep 2018 20:39:12 GMT

Almost there. Missing the "removed field prefix" as a new column value.

Re: How to use regex on field names?

tamakg — Tue, 11 Sep 2018 20:41:44 GMT

Nope. New fields are empty...

Re: How to use regex on field names?

somesoni2 — Tue, 11 Sep 2018 20:48:26 GMT

I didn't understand. What are you getting now and what's expected?