Splunk Dev

How do I filter events and extract fields in a single regular expression command

chrisxue815
Engager

Q1:
How do I merge these two regular expressions? (which are identical but one for filtering events, the other for extracting fields)

I am | regex _raw = "I am (?<Name>.*)" | rex "I am (?<Name>.*)" | stats count Count by Name

Q2:
I already tried

I am | setfields Name = 0 | rex "I am (?<Name>.*)" | where Name != 0 | stats count Count by Name

Somehow it didn't work, until I changed where Name != 0 to where not Name = 0.

From what I learnt in other answers, the behavior of Name != 0 and not Name = 0 would differ when Name doesn't exist, but in this case Name should always exist after setfields Name = 0.

Did I miss something?

Tags (1)
0 Karma

snoobzilla
Builder

Bottom line is you don't do both in same regex. It looks like you are trying to only count by Name when there is a value for Name. Try this...

I am | regex _raw = "I am (?<Name>.*)" | stats count AS Count by Name

Stats will only count the when there is a value for Name.

Should get same results with this where the search Name=* requires Name.

I am | regex _raw = "I am (?<Name>.*)" | search Name=* | stats count AS Count by Name
0 Karma

michael_kushma
Path Finder

What are you trying to do?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...