topic Backreferences in Fieldnames of rex in Splunk Search

Backreferences in Fieldnames of rex

SaltyHash123 — Wed, 01 Sep 2021 15:27:22 GMT

Hey There,

i have n Systems.

I would like to apply a rex query, where each fieldname contains the system ID which i have to extract from the logs too.

Example:

... | rex field=_raw "System(\d+)\sFailure\sRate\s(?<system_\1_failurerate>\d*)"

Unfortunately backreferencing for field name seems not to be supported.

Has anyone an idea? It needs to be added in a TA afterwards, hence eval etc. are not applicable

Thanks 🙂

Re: Backreferences in Fieldnames of rex

ITWhisperer — Wed, 01 Sep 2021 20:55:46 GMT

| rex field=_raw "System(?<number>\d+)\sFailure\sRate\s(?<system_failurerate>\d*)" | eval system_{number}_failurerate=system_failurerate

Re: Backreferences in Fieldnames of rex

SaltyHash123 — Tue, 07 Sep 2021 07:44:28 GMT

It works but i forgot to mention, that each log can have multiple matches. This solution will only find the first match in the logs

Re: Backreferences in Fieldnames of rex

ITWhisperer — Tue, 07 Sep 2021 07:47:42 GMT

Perhaps if you could share an anonymised example log entry or two - please use code block </> to share it

Re: Backreferences in Fieldnames of rex

SaltyHash123 — Tue, 07 Sep 2021 08:14:14 GMT

SystemR1 Failure Rate 17 System2 Failure Rate 3

I held the whole example abstract as i can't even share anonymized data 😕

making a rex like the following one will match the first row with system R1 but ignore system 2

| rex field=_raw "System(?<id>R?\d)\sFailure\sRate\s(?<rate>\d+) | eval system_{id}_failure = rate

using multivalues is also not possible, as this will be used as a transform in a globally available TA

Re: Backreferences in Fieldnames of rex

ITWhisperer — Tue, 07 Sep 2021 09:28:40 GMT

How about modifying the text into xml and extracting the fields that way

| makeresults | eval _raw="SystemR1 Failure Rate 17 System2 Failure Rate 3" | rex mode=sed "s/(?<system>System.+\sFailure\sRate) (?<rate>\d+)/<\1>\2<\/\1>/g s/\s+/_/g" | spath