topic How to extract values from existing field and reassign them to field? in Splunk Search

How to extract values from existing field and reassign them to field?

wts408 — Mon, 19 Sep 2022 15:44:27 GMT

Hello,

I currently have a field that contains a long string over 100+ events and in that field there are varying file sizes (609.9 KB, 1GB, 300B, etc.). What I would like to do is come up with an eval or rex command that will pull out only the file sizes and place them into a new field called File_Size. I tried using the field extractor via the GUI, but it would only pick up a couple of the file sizes and even then still wouldn’t show up in the available fields of my search. I’ve also tried creating different queries, but can’t seem to get capture groups set correctly. Can someone please advise on best approach?

Re: Extract values from existing field and reassign them to field

gcusello — Mon, 19 Sep 2022 12:50:36 GMT

Hi @wts408,

you could extract the field using the regex and then use the eval coalesce, something like this:

<your_search> | rex field=File_Size "..File_Size1.." | eval File_Size=coalesce(File_Size1,File_Size) | ...

Ciao.

Giuseppe

Re: Extract values from existing field and reassign them to field

wts408 — Mon, 19 Sep 2022 13:44:02 GMT

@gcusello - so where you say “..File_Size1..” I should put one of the actual file sizes there? I’ve tried that, but I just get an error saying the regex “xyz” does not extract anything. It should specify at least one named group. Format: (?<name>..). Thoughts?

Re: Extract values from existing field and reassign them to field

gcusello — Mon, 19 Sep 2022 14:40:09 GMT

Hi @wts408,

Sorry I wasn't so clear!

I haven't your logs so I cannot give you the correct regex to use.

With my answer I was saying: make a regex extraction using a different name for the extracted field File_Size1, so you can use it in the following coalesce command.

Ciao.

Giuseppe

Re: Extract values from existing field and reassign them to field

wts408 — Mon, 19 Sep 2022 14:47:45 GMT

@gcusello - I did some tinkering and came up with the solution!

mysearch... | rex field=_raw "FileSize: (?<File_Size>\d*.\d*\s*\w*)"

This gave me what I was looking for, which captured all of the different file sizes and the corresponding units (MB, GB, etc.).

Thanks for pointing me in the right direction!!

Re: Extract values from existing field and reassign them to field

gcusello — Tue, 20 Sep 2022 06:30:03 GMT

Hi @wts408,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉