topic Re: Reuse field extraction in another field extraction/transformation? in Splunk Search

Reuse field extraction in another field extraction/transformation?

jmartens — Mon, 23 Jul 2018 13:50:50 GMT

I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<UID>\d+(?:\.\d+)+)
as it nicely matches my UID's in forms like 1.2.3454.324234.123.123.1111 etc.

Since there are different type of UIDs in my data I would now like to reuse the UID I defined to extract the UIDs and assign them to a new field, for instance I would like to extract the UID from below and assign it to SOPInstanceUID within the same app:

Processing C-STORE-RQ for SOP Class 'STANDARD_RT_IMAGE' and SOP Instance UID '1.2.246.352.62.1.4620745920092066496.17329666369531438486'

Is it possible to reuse my already defined UID and do something like a regex like this: SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'

Re: Reuse field extraction in another field extraction/transformation?

skoelpin — Mon, 23 Jul 2018 17:00:27 GMT

Yes, just pass the field= parameter. This will tell Splunk to extract a value from an existing field

| rex field=UID SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'

Re: Reuse field extraction in another field extraction/transformation?

skoelpin — Tue, 24 Jul 2018 15:49:30 GMT

@jmartens did this help you?

Re: Reuse field extraction in another field extraction/transformation?

woodcock — Tue, 24 Jul 2018 16:02:32 GMT

You can capture the same thing multiple times like this:

... | rex "(?<UID1>(?<UID2>(?<UID3>(?<UID4>\d+(?:\.\d+)+))))