topic Re: Regex for fields that may or not be filled? in Splunk Search

Regex for fields that may or not be filled?

mrgibbon — Tue, 23 Oct 2012 22:47:09 GMT

Hey Guys, tricky one I came across.
I have to find and match on fields that may not be present.
So far I have this to find the fields when they exist:

"Source computer: (?P[^,]+) ,Source IP: (?P[^,]+)"

But it fails when the field is not filled and just looks like this:
"Source computer: " or "Source IP: ".
In fact the whole thing can look like this:
"Source computer: ,Source IP: ,"

How can I overcome this and maybe insert a "null" or "missing" string if the field is empty?
Ive tried with no success:
| fillnull value="missing" sourcecomputer
| fillnull value=NULL sourcecomputer

Anyone? Thanks in advance.

Re: Regex for fields that may or not be filled?

Rob — Tue, 23 Oct 2012 23:33:06 GMT

You may want to try using an eval statement such as;

|eval sourcecomputer=if(sourcecomputer=="", "missing", sourcecomputer)

This will rewrite your field that has an empty value (not exactly NULL) and replace it with missing and otherwise replace it with whatever is already in the sourcecomputer field.

That will work for one value at a time, otherwise, you may want to use the sed mode to replace empty values in your raw string.

|rex field=_raw mode=sed "s/:\s,/:\smissing,/g"

Re: Regex for fields that may or not be filled?

mrgibbon — Wed, 24 Oct 2012 00:42:23 GMT

Answered my own question, using * and not + at the end of the search.