Splunk Search

Can I provide a default value for a |rex command field extraction?

splunkhelp
Explorer

Good Day!

Insight would be much appreciated on the following...

The data below may or may not have the occurrence of the string 'tstp'. If 'tstp' doesn't occur, I'd like to populate the tstp_date and tst_time variables in the search below with the value 'foo'. Is it possible, in the context of a regular expression to assign 'foo' to my variables tstp_date and tstp_time if the string 'tstp' does not occur in the data?

My data looks like....

lease 1.2.3.4 {
starts 2 2014/11/11 05:47:49;
ends 2 2014/11/11 09:47:49;
tstp 2 2014/11/11 09:47:49;
cltt 2 2014/11/11 05:47:49;
binding state free;
hardware ethernet 60:33:4b:ce:83:1b;
uid "\001`3K\316\203\033";
}

lease 4.3.2.1 {
starts 2 2014/11/11 11:42:12;
ends 2 2014/11/11 15:42:12;
cltt 2 2014/11/11 11:42:12;
binding state active;
next binding state free;
hardware ethernet a4:c3:61:77:30:80;
uid "\001\244\303aw0\200";
}

My search...

   ...|  rex "^.*?lease\s+(?<lease_ip>[\d\.]+) {\s+starts \d (?<start_date>\S+) (?<start_time>\S+?);\s+ends \d (?<ends_date>\S+) (?<ends_time>\S+?);\s+(?(?=tstp)tstp \d (?P<tstp_date>\S+) (?P<tstp_time>\S+)|)" | eval tstp_date=if(isnull(tstp_date),"foo",tstp_date)

My logic was to lookahead for the occurrence of 'tstp', if that exists, then capture tstp_date (e.g. 2014/11/11) and tstp_time (e.g. 09:47:49). If you note above, I added the eval to take care of null valued 'tstp_date' and 'tstp_time', but this is done outside the regex.

Thanks!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think what you are trying to do is beyond the scope of regex. Your current approach is the best one.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

As an aside, it's a little unusual that your tstp clause is written similarly to

(what i want|)

I think it's a little more idiomatic to do

(what i want)?

Also I think the leading ? inside the group is a stray character?
I also believe the lookahead is unnecessary. You could just do

(tstp \d (?P<tstp_date>\S+) (?P<tstp_time>\S+))?

If tstp is not present, the clause won't match.

0 Karma

splunkhelp
Explorer

Agree jrodman - your suggestion is cleaner than what I was proposing. Thanks.

0 Karma

somesoni2
Revered Legend

Other alternative to your eval could be "fillnull" command.

e.g.
your search with regex ...| fillnull value="foo" tstp_date

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think what you are trying to do is beyond the scope of regex. Your current approach is the best one.

---
If this reply helps you, Karma would be appreciated.

splunkhelp
Explorer

Thanks - I wasn't sure if I had overlooked something 'regex-wise' that might have been useful.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Agreeing with Rich here, so promoting his comment to an answer.

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...