All Apps and Add-ons

Need to compile a regex for a field

mmohiuddin
Path Finder

I have a field called STATUS that is displaying two values:

STATUS=In

STATUS=IN

I need to create a regex that would extract both the values and create a single field called Status.

Is there a way to do it?

There is an option [c|C] that can be used to ignore case sensitive phrases but I am unable to extract the right regex.

0 Karma

mmohiuddin
Path Finder

I was able to find a fix for my search.

We can use:

| eval STATUS = lower(STATUS) | ..

to merge both the upper case and lower case word results

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Having some sample events would help, but this should get you started. You can also go to www.regex101.com to test regex strings.

... | rex "STATUS=(?P<Status>\w+)" | ...
---
If this reply helps you, an upvote would be appreciated.