topic Re: REX expression for multiple extractions in columns in Splunk Search

REX expression for multiple extractions in columns

raby1996 — Tue, 29 Sep 2020 13:32:23 GMT

Hello all,

I was hoping I could get a bit of assistance in figuring out a rex expression I could use to extract part numbers that are in column, I have a sample data set below,

part_num      serial_num         type
abc            123                a
bcd            234                a
cde            456                b

Essentially I'm trying to extract all the "part_num" and "serial_num" for "types" of "a", I can extract the first part that matches however I've been unable to figure out how I can extract all fields I need of type a for my events, essentially it would look like this (FYI, I already have the host machine serial number extracted)

rex....
|stats list(part_num) as part_num list(serial_num) as serial_num by host_machine

host_machine.      part_num             serial_num
981-aabbc             abc                    123
                      bcd                    234

and this would display for all my machines. Thank you, and please let me know if there are any questions, I appreciate any help

Re: REX expression for multiple extractions in columns

cpetterborg — Tue, 29 Sep 2020 13:32:28 GMT

Your sample data set looks like a CSV file. Is it?

If it is, then wouldn't you want to do a lookup by type to get the part_num and serial_num from the lookup table? That would not require a rex statement at all.

If not, what exactly is the sample data set? And is it in Splunk as an event, or what?

Re: REX expression for multiple extractions in columns

raby1996 — Tue, 04 Apr 2017 22:06:59 GMT

No unfortunately this is not csv, (or structured data), essentially this is a large text file, and this data is in tabular format somewhere towards the middle of the file, the easiest way to look at it was if we ran an "ls -t" on a unix server with the headers being at the top, and yes it is in splunk as an event.

Re: REX expression for multiple extractions in columns

woodcock — Tue, 04 Apr 2017 22:14:57 GMT

Is your "dataset" above a single event that looks exactly like that?

Re: REX expression for multiple extractions in columns

woodcock — Tue, 04 Apr 2017 22:16:20 GMT

If your "dataset" above a single event that looks exactly like that, then you need multikv:

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Multikv

Re: REX expression for multiple extractions in columns

raby1996 — Wed, 05 Apr 2017 19:40:39 GMT

Yes, your'e right, this looks like it will do the job, thank you.