topic Rex Command with multiple formatting options in Splunk Search

Rex Command with multiple formatting options

Dude — Thu, 01 Apr 2021 14:59:08 GMT

Trying to get the rex command to extract the last name when the user field has multiple formatting outputs below. Is there a way to incorporate both options into a rex command?

| rex field=user "(?<user_last_name>[A-Za-z]+),.*"

Smith, Bob

bob.t.smith.abc

Re: Rex Command with multiple formatting options

richgalloway — Thu, 01 Apr 2021 17:37:59 GMT

This regex fits the two examples, but there are many other ways to represent names.

| rex field=user "(?J)(?<user_last_name>[A-Za-z]+),.*|[^\.]+\.[^\.]+\.(?<user_last_name>\w+)"

Re: Rex Command with multiple formatting options

Dude — Thu, 01 Apr 2021 18:59:23 GMT

Each one of the halves work independently or if I create another name group they both work, but for whatever reason the (?J) modifier is not working. Also for the thread I did not know these regex modifiers existed. Regex Modifiers

Re: Rex Command with multiple formatting options

richgalloway — Thu, 01 Apr 2021 20:07:37 GMT

I forgot Splunk doesn't support (?J). Sorry about that. Try this, instead. It extracts separate last name fields and then chooses the one that is not null.

| rex field=user "(?J)(?<last_name1>[A-Za-z]+),.*|[^\.]+\.[^\.]+\.(?<last_name2>\w+)" | eval user_last_name=coalesce(last_name1, last_name2)