topic Extract the same field two different ways in Splunk Search

Extract the same field two different ways

tstanley — Mon, 28 Sep 2020 12:15:28 GMT

I want to end up with a filed called mapi_err that contains a MAPI error string. I am looking at the third line in a multi-line event which may look like:

Unpopulated address list - can't resolve names: MAPI_E_NOT_FOUND

or it may look like

Unable to create MAPI message in Outbox, HR=80040115

In the first case, the error string is in the event, MAPI_E_NOT_FOUND, so I can just extract any ": MAPI_*". In the second case, I need to extract the hex error code, 80040115, after "HR=" and then do a lookup in a CSV to get the MAPI error string. I can't figure out a way to accommodate both event formats in a search string. I've gotten the full line into mapi_err_full and then tried:

rex field=mapi_err_full ": (?&lt;mapi_err>MAPI_.*)" | rex field=mapi_err_full "HR=(?&lt;mapi_err_hex>[0-9]+)" | lookup MAPIErrorCodes "Hex" as mapi_err_hex OUTPUT "Code" as mapi_err

I really only want to do the lookup if mapi_err_hex is defined. Otherwise, when the lookup fails for events without a mapi_err_hex, it destroys the good value already in mapi_err. Do I have to resort to two separate extractions in props.conf?

Re: Extract the same field two different ways

Damien_Dallimor — Mon, 28 Sep 2020 12:15:30 GMT

See if this works for you , extract the first case to "mapi_err_1" and the hex code lookup to "mapi_err_2" , then coalesce the results into the field "mapi_err"

... | eval mapi_err=coalesce(mapi_err_1, mapi_err_2)

Re: Extract the same field two different ways

tstanley — Tue, 14 Aug 2012 15:27:59 GMT

Ahh, yes, exactly what I was looking for. I was thinking about an if() statement or field aliasing, some way to choose between two values or to combine them. I didn't know about coalesce. Works great, thanks!