How do I get a certain rex field extraction to run if a field equals a specific value?

IRHM73 — Tue, 02 Feb 2016 08:20:40 GMT

Hi,

Firstly, I'm not sure whether this is even possible, but I wonder whether someone may be able to help me please.

I've put together the following search:

  index=main auditSource=contact-frontend auditType=ServiceReceivedRequest detail.referrer!="-" OR detail.requestBody!=""  
    |rex field="detail.requestBody" "(?<selectservice>[^\=]+)"
    |rex field="detail.requestBody" "error=(?<servicecomments>[^\=]+)"
    |eval servicecomments=replace(servicecomments, "\+", " ") 
    |rex field="detail.requestBody" "error=(?<reportcomments>[^$]+)\&is"
    |eval reportcomments=replace(reportcomments, "\+", " ")
    |rex field="detail.requestBody" "action=(?<csrfcomments>[^$]+)\&is"
    |eval csrfcomments=replace(csrfcomments, "\+", " ")

In its current form, there are three fields which extract comments. These are servicecomments, reportcomments and csrfcomments which are three separate fields in my results table.

What I'd like to do is amalgamate the comments fields to one, but then have an 'if statement' so if the "selectservice" field

equals "service", then it extracts "servicecomments",
equals "report-name" then extract "reportcomments"
equals "csrf" extract "csrfcomments".

This then means that the comments would appear in one field rather than three separate ones.

I did try the following to test two of the fields, but it didn't work.

 |eval comments=if(selectservice="csrfToken",csrfcomments,servicecomments)

I just wondered whether someone may be able to look at this please and offer some guidance on how I may achieve this.

Many thanks and kind regards

Chris

Re: How do I get a certain rex field extraction to run if a field equals a specific value?

javiergn — Tue, 02 Feb 2016 09:30:52 GMT

This is what I would do:

| eval comments = case (
    selectservice == "service", servicecomments,
    selectservice == "report-name", reportcomments,
    selectservice == "csrf", csrfcomments
)
| fields - servicecomments, reportcomments, csrfcomments

Hope that helps

Re: How do I get a certain rex field extraction to run if a field equals a specific value?

IRHM73 — Tue, 02 Feb 2016 09:46:25 GMT

Hi @javiergn, thank you very much for taking the time to help me with this.

The solution works great!

Kind Regards

Chris

topic How do I get a certain rex field extraction to run if a field equals a specific value? in Splunk Search

How do I get a certain rex field extraction to run if a field equals a specific value?

Re: How do I get a certain rex field extraction to run if a field equals a specific value?

Re: How do I get a certain rex field extraction to run if a field equals a specific value?