topic Re: I want rex command to return empty string if no match in Splunk Search

I want rex command to return empty string if no match

jbrenner — Wed, 04 Sep 2024 15:31:20 GMT

Let's say I have the following SPL query. Ignore the regexes, thery're not important for the example:

index=abc | rex field=MESSAGE "aaa(?<FIELD1>bbb)" | rex field=MESSAGE "ccc(?<FIELD2>ddd)" stats count by FIELD1, FIELD2

Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches. I just want to return an empty string in the field that doesn't match. Is there a way to do this? Thanks!

Re: I want rex command to return empty string if no match

ITWhisperer — Wed, 04 Sep 2024 15:46:10 GMT

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" | rex field=MESSAGE "ccc(?<FIELD2>ddd|)"

Re: I want rex command to return empty string if no match

yuanliu — Wed, 04 Sep 2024 22:35:52 GMT

A common approach is to use fillnull.

This is a made-up dataset based on your regex.

MESSAGE

aaabbbcccddd

aaabbbcccdef

aaabccccddd

abcdefg

The above method gives

FIELD1	FIELD2	count
		1
	ddd	1
bbb		1
bbb	ddd	1

Here is an emulation to produce this data

| makeresults format=csv data="MESSAGE aaabbbcccddd aaabbbcccdef aaabccccddd abcdefg" ``` the above emulates index=abc ```

Play with it and compare with real data.

Re: I want rex command to return empty string if no match

jbrenner — Thu, 05 Sep 2024 13:40:43 GMT

Exactly what I needed. Thanks!