topic Re: How to fetch data using rex command in Splunk Search

How to fetch data using rex command

m7787580 — Fri, 09 Jun 2017 14:56:56 GMT

These are some below mentioned details which is present in splunk in exactly same format:-
New Core 12 Month CTE (2014)(HEROCN2 & HEROTV2)
Mix Core
Full House Core
Player Core
Fun Core
35% off Mix Core 12m (11887)
Full House Minor Core
Fun bundle
Full House Minor & Major Core
Full House Major Core
VIP Core
Strong kham Core
Strong Easy Core
Strong kham Minor Core
Strong Bang Core
3 for ??44 Triple Core
Strong kham Minor and Major Core
ATL Player Core (50mb & above) 12m discount 12m CTE (11957)
ACQ Strong kham Core TVXL/BBXXL/Phone M Triple with TiVo, 12 month offer (11768)
35% off Full House Core 12m (11888)

I wanted to fetch only these below mentioned names using rex command:-

Mix Core
Full House Core
Player Core
Fun Core
Full House Minor Core
Full House Major Core
VIP Core
Strong kham Core
Strong Easy Core
Strong kham Minor Core
Strong Bang Core

Could you please help me in creating the rex command which will only provide me the above mentioned details as a result.

Thanks in advance

Re: How to fetch data using rex command

somesoni2 — Fri, 09 Jun 2017 16:24:55 GMT

Are these a field values available in multiple events and you want to filter to keep only the events with field in format specified in your second list? What's your current search?

Re: How to fetch data using rex command

m7787580 — Fri, 09 Jun 2017 16:36:04 GMT

Yes these fields are present in multiple events i just want to rex out above mentioned fields from them.

I tried to use below mentioned search

|rex field=_raw "name\>(?<CoreOffering>[^\<]+)" max_match=50|top CoreOffering limit=0|search CoreOffering =*Core*|rex field=CoreOffering "(?\w*\s*[^\C]+)"

But is not extracting the exact field name which i want.

Re: How to fetch data using rex command

somesoni2 — Fri, 09 Jun 2017 16:41:07 GMT

How about this

 |rex field=_raw "name\>(?<CoreOffering>[^\<]+)" max_match=50|top CoreOffering limit=0|search CoreOffering =*Core*|rex field=CoreOffering "^(?<FilteredCoreOffering>[A-z\s]+)$

Re: How to fetch data using rex command

DalJeanis — Fri, 09 Jun 2017 18:12:54 GMT

It looks like you are trying to extract all the values, but eliminate any values that have numbers or ampersands in them.

| rex field=_raw "name\>(?<CoreOffering>[^\<]+)" max_match=50
| eval CoreOffering = mvfilter(NOT match(CoreOffering,"[&0-9]"))

However, "Strong kham Minor and Major Core" is an exception. Did you want to get rid of that?

Use this at the end if six words (with spaces between them) is enough to disqualify a result...

| eval CoreOffering = mvfilter(NOT match(CoreOffering,"\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+\S"))

Use this at the end if the word " and " is enough to disqualify a result...

| eval CoreOffering = mvfilter(NOT match(CoreOffering,"\s+and\s+"))

Re: How to fetch data using rex command

DalJeanis — Fri, 11 Aug 2017 14:41:35 GMT

@m7787580 - did you ever get a solution to this?