topic Re: Transforming Field Value with Rex/Regex? in Splunk Search

Transforming Field Value with Rex/Regex?

pamcarvalho — Thu, 19 Oct 2017 16:37:54 GMT

Hey!

So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this?

PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow.

Thanks in advance!!

Re: Transforming Field Value with Rex/Regex?

gcusello — Tue, 29 Sep 2020 16:20:56 GMT

Hi
These values are static or dynamic?
If static or near, you can put them on a lookip and then use it to filter you search, e.g.
Your_sear h [ | inputlookup my_lookip.csv | fields account ] | table account
In dynamic use a subsearch instead lookup
Your_search [ search secondary_search | dedup 0 account | fields account ] | table account
Bye.
Giuseppe

Re: Transforming Field Value with Rex/Regex?

elliotproebstel — Thu, 19 Oct 2017 17:07:43 GMT

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

Re: Transforming Field Value with Rex/Regex?

pamcarvalho — Thu, 19 Oct 2017 17:13:54 GMT

Dynamic, the user puts the users values in a Text Input this way "user1 user2 user3 user4 user5 user6 (.....)" and then I work with it in the dashboard. But thanks anyway!

Re: Transforming Field Value with Rex/Regex?

pamcarvalho — Tue, 29 Sep 2020 16:20:59 GMT

Yes!! That's it! Thank you!

I had to change a little bit to work though:

"| rex field=FormatSS mode=sed "s/(\w+)/user_id=\"&\" OR/" max_match=0 | nomv FormatSS | rex field=FormatSS mode=sed "s/^/(/ s/OR$/)/" max_match=0"

I was extracting values from mv fields.

Re: Transforming Field Value with Rex/Regex?

elliotproebstel — Thu, 19 Oct 2017 17:22:25 GMT

Great. Glad I could help!