topic Re: Extracting values (with rex) out of the last two events and concat as one string? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481741#M193113 <P>Various important points have disappeared.</P> <P>please use code sample. <CODE>101010</CODE></P> Fri, 10 Jan 2020 12:38:02 GMT to4kawa 2020-01-10T12:38:02Z Extracting values (with rex) out of the last two events and concat as one string? https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481740#M193112 <P>Hey everbody </P> <P>I have two different evens for the same file. I need to extract the latest values and concat it to one string.</P> <P>File:<BR /> foo=bar<BR /> foo1=bar1<BR /> foo2=bar2<BR /> foo3=bar3</P> <P>Event 1:<BR /> foo=new_bar<BR /> foo1=new_bar1</P> <P>Event 2:<BR /> foo2=new_bar2<BR /> foo3=new_bar3</P> <P>Search:<BR /> index=MY_INDEX sourcetype=my:source | sort - _time | head 2 | rex field=_raw "foo1=(?(.<EM>))" | rex field=_raw "foo2=(?(.</EM>))" | table NEED1 NEED2</P> <P>Output:<BR /> NEED1 NEED2<BR /> "" or "none" new_bar1<BR /> "new_bar2" "" or "none"</P> <P>Expected string:<BR /> new_bar2 new_bar3</P> <P>Is it possible?</P> <P>Thanks for your help.</P> Wed, 30 Sep 2020 03:37:45 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481740#M193112 amatthes 2020-09-30T03:37:45Z Re: Extracting values (with rex) out of the last two events and concat as one string? https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481741#M193113 <P>Various important points have disappeared.</P> <P>please use code sample. <CODE>101010</CODE></P> Fri, 10 Jan 2020 12:38:02 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481741#M193113 to4kawa 2020-01-10T12:38:02Z Re: Extracting values (with rex) out of the last two events and concat as one string? https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481742#M193114 <P>Im not sure if I parsed your question correctly but based from what I understand you want to get the 2 latest events and concat it with a string. Based from your given example your log is in key/field=value form so that is automatically extracted . If you want to get the latest values it is better to use stats, its a lot faster and efficient instead of using sort which is too intensive , sorting should always be in the last. </P> <P><CODE>index=MY_INDEX sourcetype=my:source stats latest <BR /> | stats latest(foo1) as foo1 latest(foo2) as foo2<BR /> | eval NEED1="new_".foo1<BR /> | eval NEED2="new_".foo2<BR /> | table NEED1 NEED2</CODE></P> <P>Just incase you need a rex <CODE>|rex field=_raw "fo(\w|\w\d+)\=(?&lt;value&gt;[a-z0-9].*)"</CODE></P> Fri, 10 Jan 2020 13:35:59 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-values-with-rex-out-of-the-last-two-events-and-concat/m-p/481742#M193114 jarizeloyola 2020-01-10T13:35:59Z