topic Re: Why is my rex search not extracting the field from my event? in Splunk Search

Why is my rex search not extracting the field from my event?

hqw — Thu, 25 Jun 2015 06:44:29 GMT

Dear all,

I want to extract a field from the event, and name it retail, and then use this new field to make a calculation. Could you pls help me to achieve this?

This portion from my event below mount_name="MerryMart-An-Wai, I want to extract MerryMart, the first word of mount_name.

This is my current search:

interaction_count | rex field = mount_name"(?<retail>-.*)" | stats sum(interaction_count) by retail

but I got nothing returned. Could you kindly tell me what is wrong?

Event:

Jun 25 2015 05:00:00 geoloc_city="**" geoloc_country="**" menu_interaction_count="0" menu_interaction_duration="0" menu_select_experience="0" mount_name="MerryMart-An-Wai " shop_id="d3ba599ad84f4eb69b5321b90e958b30" shop_name="MerryMart-An-Wai"

Re: Why is my rex search not extracting the field from my event?

ngatchasandra — Thu, 25 Jun 2015 07:41:09 GMT

Hi,
Try with:

 interaction_count|rex field=_raw "mount_name\=\"(?<retail>[A-Z a-z]+)\-" | stats sum(interaction_count) by retail

Re: Why is my rex search not extracting the field from my event?

vganjare — Thu, 25 Jun 2015 07:43:03 GMT

You can try IFX which is easy to use. Following tutorial can help you.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX

Thanks!!

Re: Why is my rex search not extracting the field from my event?

chimell — Thu, 25 Jun 2015 11:34:03 GMT

Hi hqw
Try this search code

 interaction_count | rex field=_raw "mount_name\=\"(?P<retail>[\w]+)\-"| stats sum(interaction_count) by retail

Look at the result of " MerryMart" extraction (first word of mount_name )

Re: Why is my rex search not extracting the field from my event?

chimell — Fri, 26 Jun 2015 13:36:02 GMT

Thanks but you forgot to vote