Splunk Enterprise Security

Splunk Enterprise Security: How to do conditional regex?

mikeyph
New Member

I'm trying to unify records from two different indexes, as part of this I'm trying to create a common field by extracting user ID's from existing fields (these are full of other data I don't want and which isn't unified). It's working in so far as my regex matches as expected, however there are variants in userID types, such as emails with first and surname, emails with a single name, a one-word user ID etc.
I can regex for these easily enough but it will overwrite the previous field contents for my working regex, and I want all input into 1 field.

How do I do conditional regex?
i.e. where first regex fails to match on record, try next regex.

Below is an example I have that is correctly returning the fullname email into the new field.
This obviously doesn't match on any of the other examples I gave- meaning I have multiple blank cells.

|rex field=first_index_field \{\"id\"\:\"(?<Common_Field>\w+\.\w+\@\w+\.\w+)
|rex field=second_index_field .*sername\=(?<Common_Field>\w+\.\w+\@\w+\.\w+)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @mikeyph,
you could extract all the fullnames using different regex for each sourcetype as you did but with different field names (e.g. Common_Field1, Common_Field2) and then unify them using coalesce:

my_search
|rex field=first_index_field \{\"id\"\:\"(?<Common_Field1>\w+\.\w+\@\w+\.\w+)
|rex field=second_index_field .*sername\=(?<Common_Field2>\w+\.\w+\@\w+\.\w+)
| eval Common_Field=coalesce(Common_Field1,Common_Field2)
| ...

Ciao.
Giuseppe

Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...