All Apps and Add-ons

Need to compile a regex for a field

Path Finder

I have a field called STATUS that is displaying two values:



I need to create a regex that would extract both the values and create a single field called Status.

Is there a way to do it?

There is an option [c|C] that can be used to ignore case sensitive phrases but I am unable to extract the right regex.

0 Karma

Path Finder

I was able to find a fix for my search.

We can use:

| eval STATUS = lower(STATUS) | ..

to merge both the upper case and lower case word results

0 Karma


Having some sample events would help, but this should get you started. You can also go to to test regex strings.

... | rex "STATUS=(?P<Status>\w+)" | ...
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...