https://community.splunk.com/t5/Splunk-Search/How-to-rex-field-to-a-field/m-p/467579#M131591 <P>I have a rex as such:</P> <PRE><CODE>| rex field=host "(?&lt;sydney&gt;10-92-3[2-4])" | rex field=host "(?&lt;melbourne&gt;10-92-11[0-2])" </CODE></PRE> <P>which returns 2 fields. <STRONG>sydney</STRONG> and <STRONG>melbourne</STRONG></P> <P>Now I want to have the fields returned to a field <STRONG>city</STRONG>. How can i do this? </P> Tue, 07 Apr 2020 01:18:29 GMT racans 2020-04-07T01:18:29Z https://community.splunk.com/t5/Splunk-Search/How-to-rex-field-to-a-field/m-p/467579#M131591 <P>I have a rex as such:</P> <PRE><CODE>| rex field=host "(?&lt;sydney&gt;10-92-3[2-4])" | rex field=host "(?&lt;melbourne&gt;10-92-11[0-2])" </CODE></PRE> <P>which returns 2 fields. <STRONG>sydney</STRONG> and <STRONG>melbourne</STRONG></P> <P>Now I want to have the fields returned to a field <STRONG>city</STRONG>. How can i do this? </P> Tue, 07 Apr 2020 01:18:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rex-field-to-a-field/m-p/467579#M131591 racans 2020-04-07T01:18:29Z https://community.splunk.com/t5/Splunk-Search/How-to-rex-field-to-a-field/m-p/467580#M131592 <P>If you use REX</P> <PRE><CODE>| makeresults |eval host ="10-92-110"|eval city=host | rex field=city mode=sed "s/10-92-3[2-4]/sydney/g" | rex field=city mode=sed "s/10-92-11[0-2]/melbourne/g" </CODE></PRE> <P>In my case I use LOOKUP to convert.</P> Tue, 07 Apr 2020 02:30:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rex-field-to-a-field/m-p/467580#M131592 HiroshiSatoh 2020-04-07T02:30:31Z