topic Re: Comparison of a field with a digit with a field where there are alphabetic characters. in Splunk Search

How to make comparison of a field with a digit with a field where there are alphabetic characters?

metylkinandrey — Wed, 05 Oct 2022 13:23:41 GMT

Prompt as I can make arithmetic comparison of two fields. Comparison: more, less.
The first field consists of numbers: field="1", field="2"
The second of numbers and letters: field="1.route", field="2.route"

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

gcusello — Wed, 05 Oct 2022 06:51:18 GMT

Hi @metylkinandrey,

if the structure of the second field is fixed, you can use a regex to extract a part of the second field to compare with the first field, something like this:

<your_search> | rex field=field2 "^(?<field2_num>\d+)\." | search field1=field2_num

Ciao.

Giuseppe

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

metylkinandrey — Wed, 05 Oct 2022 13:58:01 GMT

Giuseppe, Hello!
I do not quite understand how it works, it gives an error:
error in 'rex' command: The regex '(routepointID)=routepointID2' does not extract anything. It should specify at least one named group. Format: (?<name>...).

What am I doing:
| rex routepointID=routepointID2 "^(?<routepointID2_num>\d+)\."

What I need:
Where: "routepointID": "1.SAPS-SIS.TO.LSP.SEND" or "routepointID": "2.SAPS-SIS.TO.LSP.RECEIVE"

I want to receive: "routepointID2_num": "1" or "routepointID2_num": "1"

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

gcusello — Wed, 05 Oct 2022 15:13:56 GMT

Hi @metylkinandrey,

read again the rex command syntax at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Rex :

| rex field=routepointID "^(?<routepointID_num>\d+)\."

Could youshare a sample of your logs?

I have to understand if you have both the values in the same event or in two different events for the comparison.

Ciao.

Giuseppe

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

metylkinandrey — Thu, 06 Oct 2022 09:55:05 GMT

Giuseppe, within one message, the field can take only one value, either: 1.SAPS-SIS.TO.LSP.SEND, or: "2.SAPS-SIS.TO.LSP.RECEIVE".
I still don't understand what I need
AT:
| rex field=routepointID "^(?<routepointID_num>\d+)\."
What does refer to: field?
Am I doing the right thing if I want to get a new field "routepointIDnum": "1" or "routepointIDnum": "2"
So?
| rex routepointIDnum=routepointID "^(?<routepointID_num>\d+)\."

<routepointID_num> - what should I substitute instead?

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

gcusello — Thu, 06 Oct 2022 10:20:19 GMT

Hi @metylkinandrey,

as you can read in the above link (https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Rex ), in the rex command you can specify a field for regex application,

in other words, if you don't specify any field, the regex is applied to the entire event (_raw),

if instead you specify a field, the regex is appliad, as in your case, only to the specified field.

The meaning of the command I sent you is:

take in the field "routepointID" the number that is at the beginning of the field and put it in a field called "routepointID_num"

In this way, in the routepointID_num field you have the numbers to match.

For this reason you cannot put the condition in the rex command, but you have to put it in the following command.

The questions now are:

are the two values of routepointID field for field extraction and comparison in the same event or in two different events?
and, if they are in two events, how can I correlate them? there's a common value in a field (a correlation key)?

Ciao.

Giuseppe

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

metylkinandrey — Thu, 06 Oct 2022 11:08:28 GMT

Giuseppe, thank you!

Figured it out, it worked:

index="main" sourcetype="testsystem-script333"

| rex field=routepointID "^(?<routepointID_num>\d+)\."

| table routepointID_num

Re: Comparison of a field with a digit with a field where there are alphabetic characters.

gcusello — Thu, 06 Oct 2022 12:12:21 GMT

Hi @metylkinandrey,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉