Archive

Does the rex command filter events if the regular expression fails to match

Explorer

I'm trying to use a regular expression in a summary query. I want to get all events so that nothing is omitted and I can gather count statistics on all events, even if a regular expression fails to match in the rex command.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The rex command will not filter or remove any events, even if the rex doesn't match. The regex command is used to filter and remove events based on a regular expression.

If the rex fails to match a field, that field won't be present in that event.

index=foo | rex field=_raw "Hello (?<match>.*)"

For this data, you'll get the following

_raw match
Hello world! world!
Goodbye for now

You can then use the fillnull command to put a default value in fields where the value is NULL.

index=foo | rex field=_raw "Hello (?<match>.*)" | fillnull value="EMPTY" match

Which will give you the following results

_raw match
Hello world! world!
Goodbye for now EMPTY

View solution in original post

Splunk Employee
Splunk Employee

The rex command will not filter or remove any events, even if the rex doesn't match. The regex command is used to filter and remove events based on a regular expression.

If the rex fails to match a field, that field won't be present in that event.

index=foo | rex field=_raw "Hello (?<match>.*)"

For this data, you'll get the following

_raw match
Hello world! world!
Goodbye for now

You can then use the fillnull command to put a default value in fields where the value is NULL.

index=foo | rex field=_raw "Hello (?<match>.*)" | fillnull value="EMPTY" match

Which will give you the following results

_raw match
Hello world! world!
Goodbye for now EMPTY

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!