Splunk Search

Does the rex command filter events if the regular expression fails to match?

entpnerd
Explorer

I'm trying to use a regular expression in a summary query. I want to get all events so that nothing is omitted and I can gather count statistics on all events, even if a regular expression fails to match in the rex command.

Labels (1)
Tags (1)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

The rex command will not filter or remove any events, even if the rex doesn't match. The regex command is used to filter and remove events based on a regular expression.

If the rex fails to match a field, that field won't be present in that event.

index=foo | rex field=_raw "Hello (?<match>.*)"

For this data, you'll get the following

_raw match
Hello world! world!
Goodbye for now

You can then use the fillnull command to put a default value in fields where the value is NULL.

index=foo | rex field=_raw "Hello (?<match>.*)" | fillnull value="EMPTY" match

Which will give you the following results

_raw match
Hello world! world!
Goodbye for now EMPTY

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

The rex command will not filter or remove any events, even if the rex doesn't match. The regex command is used to filter and remove events based on a regular expression.

If the rex fails to match a field, that field won't be present in that event.

index=foo | rex field=_raw "Hello (?<match>.*)"

For this data, you'll get the following

_raw match
Hello world! world!
Goodbye for now

You can then use the fillnull command to put a default value in fields where the value is NULL.

index=foo | rex field=_raw "Hello (?<match>.*)" | fillnull value="EMPTY" match

Which will give you the following results

_raw match
Hello world! world!
Goodbye for now EMPTY

otheus
Explorer

You know, it would be great if the reference page in the online manual for "rex" indicated your answer.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...