topic Re: rex help in Splunk Search

rex help

darkins — Sat, 23 Nov 2024 13:38:34 GMT

probably an easy one, i have two events as follows

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

meaning in some events field2 exists, in some it doesnt, when it does i want the value and when it doesnt i want it to be blank and all records have mynextfield3 and i always want that as field3

i want rex these lines and end up with

field1 field2 field3

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

Re: rex help

marnall — Sat, 23 Nov 2024 13:49:19 GMT

Assuming that field1 and field3 are always at the beginning and end of the line respectively, and assuming that their values do not contain spaces, and assuming they are separated by spaces, you could use this:

^(?<field1>\S+)\s*(?<field2>\S+)?\s(?<field3>\S+)$

Re: rex help

gcusello — Sun, 24 Nov 2024 09:17:19 GMT

Hi @darkins ,

could you share some samples of your logs, highlighting the strings to extract?

Ciao.

Giuseppe

Re: rex help

PickleRick — Sun, 24 Nov 2024 12:07:31 GMT

It all depends how your fields are delimited/anchored. @marnall 's answer is obvious if you have just two or three words separated by spaces. If your "layout" is different, you have to adjust it.

Re: rex help

darkins — Sun, 24 Nov 2024 23:50:28 GMT

not sure what else to put, this is what my data looks like

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

i want these two lines to display as

field1 field2 field3

thisisfield1 thisisfield2 mynextfield3

thisisfield1 mynextfield3

Re: rex help

darkins — Sun, 24 Nov 2024 23:54:51 GMT

i guess the key is i think i need to say that field2 equals everything up to an m PRECEDED by a space?

Re: rex help

gcusello — Mon, 25 Nov 2024 07:29:35 GMT

Hi @darkins ,

ad also @PickleRick and @marnall said, the regex depends on the log, so it's difficoult to create a regex without some sample.

If you have three words, separated by a space and somethimes there are only two words without any other rule, it's not possible to define a regex; if instead there's some additional rule in the firstfields or in the nextfield, it's possible to identify a regex.

Ciao.

Giuseppe

Re: rex help

PickleRick — Mon, 25 Nov 2024 08:21:02 GMT

The thing is that regex must match your data properly so we can't just "assume" something out of the blue.

You can fiddle with the regex for yourself (and see how and why it works)

https://regex101.com/r/VaY5Qn/1