Knowledge Management

field extraction - regex handle fields with no values

pc1234
Explorer

I'm trying to write a field extraction on the search head using a regex .

the sample data is as follows

FIELDS: user,email,type,ip

EVENT1: abc,abc@xyz.com,password ,127.0.0.1

EVENT2: xyz,,,127.0.0.5

the fields are comma-delimited whether or not there are values for each fields . In second event, email and type fields have no values(user and ip fields ALWAYS have values) 

Can someone assist me in a regex to handle all fields? if the field has no value (email or type) assign no values to the fields .

Thanks in advance.

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...