Getting Data In

how to rex comma with no data

ravir_jbp
Explorer

I hve few events where data is not available. Instead I see commas where head6 and head7 data is not availble. Need rex so that I get output blank if no data but if data is available then it should provide output. below is the event (three commas beside between UNKNOWN AND /TEST)

 

head1,head2,head3,head4,head5,head6,head7,head8,head9,head10,head11,head12

sadfasdfafasdfs,2024-06 21T01:33:30.918000+00:00,test12,1,UNKNOWN,,,/test/rrr/swss/customer1/454554/test.xml,UNKNOWN,PASS,2024-06-21T01:33:30.213000+00:00,UNKNOWN

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex "(?<head1>[^,]*),(?<head2>[^,]*),(?<head3>[^,]*),(?<head4>[^,]*),(?<head5>[^,]*),(?<head6>[^,]*),(?<head7>[^,]*),(?<head8>[^,]*),(?<head9>[^,]*),(?<head10>[^,]*),(?<head11>[^,]*),(?<head12>[^,]*)"

The fields will be null so you could use fillnull to give them values e.g.

| fillnull value="N/A"

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...