https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523901#M147808 <P>Hello,</P><P>I´m trying to load custom rex field extraction if another field has a certain value, for example:<BR /><BR />if logtype=system<BR />&nbsp; &nbsp; &nbsp;then</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;search | rex field=_raw .....</P><P>if logtype= application<BR />&nbsp; &nbsp; &nbsp; then<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;search | rex field=_raw ....</P><TABLE border="1" width="100%"><TBODY><TR><TD width="33.333333333333336%" height="25px">logtype</TD><TD width="33.333333333333336%" height="25px">username</TD><TD width="33.333333333333336%" height="25px">_raw</TD></TR><TR><TD width="33.333333333333336%" height="25px">system</TD><TD width="33.333333333333336%" height="25px">&nbsp;</TD><TD width="33.333333333333336%" height="25px">user=002</TD></TR><TR><TD width="33.333333333333336%" height="25px">application</TD><TD width="33.333333333333336%" height="25px">&nbsp;</TD><TD width="33.333333333333336%" height="25px">suser=004</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks in advance!</P> Fri, 09 Oct 2020 12:28:35 GMT cpm003 2020-10-09T12:28:35Z https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523901#M147808 <P>Hello,</P><P>I´m trying to load custom rex field extraction if another field has a certain value, for example:<BR /><BR />if logtype=system<BR />&nbsp; &nbsp; &nbsp;then</P><P>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;search | rex field=_raw .....</P><P>if logtype= application<BR />&nbsp; &nbsp; &nbsp; then<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;search | rex field=_raw ....</P><TABLE border="1" width="100%"><TBODY><TR><TD width="33.333333333333336%" height="25px">logtype</TD><TD width="33.333333333333336%" height="25px">username</TD><TD width="33.333333333333336%" height="25px">_raw</TD></TR><TR><TD width="33.333333333333336%" height="25px">system</TD><TD width="33.333333333333336%" height="25px">&nbsp;</TD><TD width="33.333333333333336%" height="25px">user=002</TD></TR><TR><TD width="33.333333333333336%" height="25px">application</TD><TD width="33.333333333333336%" height="25px">&nbsp;</TD><TD width="33.333333333333336%" height="25px">suser=004</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks in advance!</P> Fri, 09 Oct 2020 12:28:35 GMT https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523901#M147808 cpm003 2020-10-09T12:28:35Z https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523912#M147814 <P>If the rex doesn't match then the field isn't extracted so why can't you just both rex and let one pick up user= and the other pick up suser=?</P> Fri, 09 Oct 2020 12:59:40 GMT https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523912#M147814 ITWhisperer 2020-10-09T12:59:40Z https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523913#M147815 <P>Try something like this run-anywhere example.&nbsp; I'll leave to you get the logtype field into the subsearch.</P><LI-CODE lang="markup">| makeresults | eval _raw="This event contains user=002 so it should match system logtypes" | regex _raw=[|makeresults | eval logtype="system" | eval match=case(logtype="application","user=002", logtype="system","suser=004", 1==1, "XXnoMatchXX") | return $match]</LI-CODE><P>&nbsp;</P> Fri, 09 Oct 2020 13:01:33 GMT https://community.splunk.com/t5/Splunk-Search/In-search-Dynamic-REX-loading/m-p/523913#M147815 richgalloway 2020-10-09T13:01:33Z