topic How to use rex to extract a field that starts with another field value? in Splunk Search

How to use rex to extract a field that starts with another field value?

pedromvieira — Mon, 23 Mar 2015 17:52:15 GMT

Hi.

I'd like to rex a field that starts with another field value.

EX:

****Data

UA=Mozilla/5.0 (Linux; Android 4.0.3; GT-I9100 Build/IML74K) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19
AV=18.0.1025

****Desired

AV2=18.0.1025.166

****Search

| inputlookup VERSION.csv
| rex field=UA "<AV>.(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)

Re: How to use rex to extract a field that starts with another field value?

somesoni2 — Mon, 23 Mar 2015 20:06:13 GMT

Give this a try

| inputlookup VERSION.csv
| eval UA1=replace(UA,AV.".","MyField=")
| rex field=UA1 "MyField=(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
| fields - UA1

Re: How to use rex to extract a field that starts with another field value?

pedromvieira — Mon, 23 Mar 2015 20:19:29 GMT

Perfect. Thanks.