https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104321#M27013 <P>Why not combine them into one rex statement with multiple ability to match multiple times.</P> <P><CODE></CODE><PRE><CODE><BR /> rex field="Location"(?<NLOC>(?im)"(delhi|mumbai|kol)") <BR /> </NLOC></CODE></PRE></P> Fri, 26 Oct 2012 21:58:14 GMT bmacias84 2012-10-26T21:58:14Z https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104319#M27011 <P>Hi,</P> <P>I have a query as follows :</P> <P>index="maa" |rex field="Location" (?<ONE>(?i)"delhi") | eval ONE=lower(ONE) |stats count(ONE) by ONE | append [search index="maa" |rex field="Location" | (?<ONE>(?i)"kol") | eval ONE=lower(ONE) |stats count(ONE) by ONE ] | append [ search index="maa" | rex field="Location" (?<ONE>(?i)"mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE]</ONE></ONE></ONE></P> <P>Here, I am using 3 keywords "delhi","kol" and "mumbai" but I have used 3 rex for this..can I merge three into one rex. when I am merging as follows I am getting the correct count for the keywords. Please help</P> <P>index "maa" | rex field="Locaion" (?<ONE>(?i)"delhi|kol|mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE</ONE></P> Fri, 26 Oct 2012 19:36:08 GMT https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104319#M27011 abhayneilam 2012-10-26T19:36:08Z https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104320#M27012 <P>Hi Abhay..</P> <P>You can create field aliases for your thress rex fields as location and then you can use the stats count by location like this .</P> <P>rex field="Location" (?<DELHI>(?i)"delhi") <BR /> rex field="Location" | (?<KOL>(?i)"kol") <BR /> rex field="Location" (?<MUMBAI>(?i)"mumbai") </MUMBAI></KOL></DELHI></P> <P>Now go to Field Aliases and create a common alias for these three fields i.e say location .</P> <P>Then use your query like this..</P> <P>index="maa" | stats count by location </P> <P>Would you give the desired results..</P> Fri, 26 Oct 2012 21:05:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104320#M27012 rakesh_498115 2012-10-26T21:05:32Z https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104321#M27013 <P>Why not combine them into one rex statement with multiple ability to match multiple times.</P> <P><CODE></CODE><PRE><CODE><BR /> rex field="Location"(?<NLOC>(?im)"(delhi|mumbai|kol)") <BR /> </NLOC></CODE></PRE></P> Fri, 26 Oct 2012 21:58:14 GMT https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104321#M27013 bmacias84 2012-10-26T21:58:14Z https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104322#M27014 <P>the problem is, that in the data multiple city occur at the same line:</P> <P>abhay|26|koldelhigmumbaiis_delhiood_di<BR /> murari|30|ranigang<BR /> abc|32|mumbai is delhi place<BR /> murari|30|ranigang_kolbabbu is kol<BR /> murari|30|delHI is not in kolkata<BR /> mno|100|delhi<BR /> murari|30|ranig<BR /> xyz|100|delhi</P> <P>abhayneilam want to match only ONE city per line, either delhi, kol or mumbai.<BR /> I cannot create any regex matching this pattern on gskinner....sorry but on the other hand I'm no regex expert after all <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 28 Sep 2020 12:42:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-merge-multiple-rex-commands/m-p/104322#M27014 MuS 2020-09-28T12:42:23Z