topic Re: eval / rex a field and change its output in Splunk Search

eval / rex a field and change its output

spluzer — Wed, 11 Dec 2019 13:23:45 GMT

hello all,

I have a lookup with two fields sourcetype and interval ( like below) ..some of the intervals are in seconds (which is great) - However some are in cron like (14 01 * * *) --I need to change the ones in cron to 86400 ...Any ideas

sourcetype          interval


blah                  300

blah2               15 01 * * * *

blah3               3600

blah4                18 02 * * *

Here is my comically bad regex I've been working with, but cant seem to make it work

| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| dedup sourcetype
| eval output=if(match(interval="(\d+)(\d+).(\d).(*).(*).(*)")),"86400","interval")

| table sourcetype interval output

Thanks!

Re: eval / rex a field and change its output

to4kawa — Wed, 11 Dec 2019 13:46:18 GMT

| rest splunk_server=local /services/data/inputs/script
| search (disabled = 0 AND interval=*)
| eval output=if(match(interval,"^-?\d+$"),"interval","86400")
| stats values(interval) as interval values(output) as output by sourcetype

Hi, @spluzer
How about this?

Re: eval / rex a field and change its output

spluzer — Wed, 11 Dec 2019 13:58:08 GMT

Awesome thanks!..You answered my question perfectly, and will accept accordingly. However, I now realize that it probably makes more sense for me to "replace" the intervals with a cron schedule with 86400 rather than create a new field called output ( for the sake of writing it to a lookup)...Do you have a way to do that...I can ask it in other question form if you prefer...Thanks again!

Re: eval / rex a field and change its output

vnravikumar — Wed, 11 Dec 2019 14:30:49 GMT

Check this

| rest splunk_server=local /services/data/inputs/script 
| search (disabled = 0 AND interval=*) 
| eval interval=if(match(interval,"^-?\d+$"),'interval',"86400") 
| stats values(interval) as interval by sourcetype

Re: eval / rex a field and change its output

spluzer — Wed, 11 Dec 2019 14:39:19 GMT

Yep, that does it. I'm an idiot ..lol...Thanks!