Reporting

Extracting multiple values from Rex

nirmeshsolanki
Explorer

Hello,

Looking for some assistance with the existing query
rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"|
eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1)

 

This query gives us a column with outputs

 

ovverride.png

Need assistance with pulling exact details in the column which will only have "OVERRIDE". 

Thanks

1 Solution

Nisha18789
Builder

Hi @nirmeshsolanki , can you try this and let me know if it works

|rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\""
|where isnotnull(IP_Block_Type)

View solution in original post

to4kawa
Ultra Champion

| rex "(?<your_want>\bOVERRIDE\b)"
| where isnotnull(your_want)
how about this?

Nisha18789
Builder

Hi @nirmeshsolanki , my bad but I am not sure what result you are expecting in field IP_Block_Type in final output, can you share the expected output you are looking for.

 

 

0 Karma

nirmeshsolanki
Explorer

Hi @Nisha18789 , I am looking for an output "OVERRIDE" in the column IP_BLOCK_TYPE.

so we have the below outputs in the column: 

Public
Private",descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"},operation="OVERRIDE
 
Public",operation="OVERRIDE

But I am just looking for values containing OVERRIDE.

Thanks 

Nisha18789
Builder

Hi @nirmeshsolanki , can you try this and let me know if it works

|rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\""
|where isnotnull(IP_Block_Type)

nirmeshsolanki
Explorer

Hi @Nisha18789 

 

Thanks a lot for the help in the previous query, I missed adding one more detail on the previous post which is :

Messages which I see in my column:

1.[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]

2.[name="IPBLOCKTYPE",value="Public",descendants_action={​​​​​​​​option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"}​​​​​​​​,operation="OVERRIDE"]

Your solution works perfectly for 1st logic, need to add some query to the second option which would block descendants_action in the query which you provided earlier.

Thanks a lot again.

0 Karma

nirmeshsolanki
Explorer

Worked perfectly.

 

Thanks a lot.

0 Karma

somesoni2
Revered Legend

What's the raw data for which your regex currently extract those field values?

 

Give this a try as well.

rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>[^\"]+)"

nirmeshsolanki
Explorer

@somisoni2 the query you provided gives me "Publi" and "Privat" outputs in the table.

0 Karma

nirmeshsolanki
Explorer

@somesoni2 The query you provided, gives me all the possible results which come under IP_BLOCK_TYPE

override_max.png

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...