Splunk Dev

How do I filter events and extract fields in a single regular expression command

chrisxue815
Engager

Q1:
How do I merge these two regular expressions? (which are identical but one for filtering events, the other for extracting fields)

I am | regex _raw = "I am (?<Name>.*)" | rex "I am (?<Name>.*)" | stats count Count by Name

Q2:
I already tried

I am | setfields Name = 0 | rex "I am (?<Name>.*)" | where Name != 0 | stats count Count by Name

Somehow it didn't work, until I changed where Name != 0 to where not Name = 0.

From what I learnt in other answers, the behavior of Name != 0 and not Name = 0 would differ when Name doesn't exist, but in this case Name should always exist after setfields Name = 0.

Did I miss something?

Tags (1)
0 Karma

snoobzilla
Builder

Bottom line is you don't do both in same regex. It looks like you are trying to only count by Name when there is a value for Name. Try this...

I am | regex _raw = "I am (?<Name>.*)" | stats count AS Count by Name

Stats will only count the when there is a value for Name.

Should get same results with this where the search Name=* requires Name.

I am | regex _raw = "I am (?<Name>.*)" | search Name=* | stats count AS Count by Name
0 Karma

michael_kushma
Path Finder

What are you trying to do?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...