topic Re: Renaming Rex field in Splunk Search

How do I rename a Rex field?

sid_1435 — Fri, 03 Feb 2023 16:05:50 GMT

Hi ,

I want to rename to Required Parameters Longitude and Latitude are missing or invalid to a new value Required Parameters missing.

index="****" k8s.namespace.name="*****" "Error" OR "Exception" | rex field=_raw "(?<error_msg>Required Parameters Longitude and Latitude are missing or invalid)" | stats count by error_msg | sort count desc

Any help will be great

Re: Renaming Rex field

diogofgm — Fri, 03 Feb 2023 12:58:00 GMT

Use | rex with SED mode

| makeresults | eval error_msg = "Required Parameters Longitude and Latitude are missing or invalid" | rex field=error_msg mode=sed "s/(Required Parameters) .* (missing) .*/\1 \2/g"

Re: Renaming Rex field

ITWhisperer — Fri, 03 Feb 2023 12:55:17 GMT

| eval error_msg=if(match(_raw, "Required Parameters Longitude and Latitude are missing or invalid"),"Required Parameters missing", error_msg)

Re: Renaming Rex field

sid_1435 — Fri, 03 Feb 2023 13:29:48 GMT

Hi Again,

I have the drilldown on the field

Required Parameters Longitude and Latitude are missing or invalid

But since we have renamed it to

Required Parameters missing

it is sending renamed value as parameter , rather i want the original value as parameter

Can you please suggest how to do that

Re: Renaming Rex field

ITWhisperer — Fri, 03 Feb 2023 14:26:06 GMT

Add a condition to the drilldown so that if the value is "Required Parameters missing" change it to "Required Parameters Longitude and Latitude are missing or invalid" in the drilldown action

Re: Renaming Rex field

sid_1435 — Mon, 06 Feb 2023 07:18:50 GMT

Thanks ,

It worked