topic What would be the regular expression when using rex to match fields that end with a range of values? in Splunk Search

What would be the regular expression when using rex to match fields that end with a range of values?

dzyfer — Mon, 26 Sep 2022 15:25:13 GMT

What would be the regular expression when using rex to match fields that end with a range of values?

Sample:
"var0":0,"var1":10,"var2":20,"var10":100

I would like to extract fields from var1 to var10, and exclude var0.

Thanks

Re: Using rex to match range of digits

yuanliu — Mon, 26 Sep 2022 04:39:33 GMT

Regex is not needed for this kind of format; extract, aka kv, is sufficient. If this is in _raw, simply do

| kv kvdelim=":" pairdlim=","

If it is in a field named "data", you can do

| rename _raw AS temp, data AS _raw | kv kvdelim=":" pairdlim="," | rename _raw as data, temp AS _raw

Re: Using rex to match range of digits

bowesmana — Mon, 26 Sep 2022 05:06:08 GMT

A search time extraction if extract does not do what you want is (from rex statement onwards - first two lines create your sample)

| makeresults | eval _raw="\"var0\":0,\"var1\":10,\"var2\":20,\"var10\":100" | rex max_match=0 "\"(?<key>var[1-9]\d*)\":(?<value>[^,]*)" | foreach 0 1 2 3 4 5 6 7 8 9 [ eval k=mvindex(key, <<FIELD>>), v=mvindex(value, <<FIELD>>), {k}=v ] | fields - key value k v