Knowledge Management

field extraction - regex handle fields with no values

pc1234
Explorer

I'm trying to write a field extraction on the search head using a regex .

the sample data is as follows

FIELDS: user,email,type,ip

EVENT1: abc,abc@xyz.com,password ,127.0.0.1

EVENT2: xyz,,,127.0.0.5

the fields are comma-delimited whether or not there are values for each fields . In second event, email and type fields have no values(user and ip fields ALWAYS have values) 

Can someone assist me in a regex to handle all fields? if the field has no value (email or type) assign no values to the fields .

Thanks in advance.

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<user>[^,]*),(?<email>[^,]*),(?<type>[^,]*),(?<ip>[^,]*)"
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...