Extracting rex field with a newly extracted rex field

[griffinpair]

Below is the current search I have put together to extract a couple fields. The extraction of the ClientID from the source works perfect. I now need to extract the filetype from the import_File field based on the previously extracted ClientID.

Search:

source=*D:\\XSP\\importhelpers* source=*IH_Daily\\DebugImportHelper* Moved earliest=-36h@h
| rex field=source "importhelpers\\\\+(?ClientID[^\\\\]+)"
| rex field=import_File ""ClientID"\\\\\\\\\\+(?filetype[^\\]+)"

import_File Examples:

D:\XSP\Builds\IRM\InternalImports\IRM\Account\IRM_Accounts_20170810_csv.xml 
D:\XSP\Builds\USBI\InternalImports\IRM\Manager\IRM_Accounts_20170810_csv.xml 

• In these examples I am trying to extract from the import_File where file_Type will be Account or Manager.
• It is important to note that IRM and USBI right before that is the ClientID that is extracted from the first rex field. This ClientID will be different for each client and I will need to extract the filetype based on this.

[woodcock]

If I understand you correctly, you would like to use the values of the previously generated-by-rex-at-search-time field ClientID inside of a later rex call as part of the RegEx string/pattern, right?

[somesoni2]

If the field import_File contains both ClientID and filetype, why not just extract ClientID along with filetype from import_File field only. This way you can avoid reference previously extracted value (dynamic) in your 2nd rex.

source=*D:\\XSP\\importhelpers* source=*IH_Daily\\DebugImportHelper* Moved earliest=-36h@h
| rex field=import_File "InternalImports\\\\(?<ClinetID>[^\\\]+)\\\\(?<filetype>[^\\\]+)"

[sbbadri]

@griffinpair

Assuming that IRM and USBI are clientID's. Account and Manager are filetype's

| makeresults | eval import_File="D:\XSP\Builds\IRM\InternalImports\IRM\Account\IRM_Accounts_20170810_csv.xml;D:\XSP\Builds\USBI\InternalImports\IRM\Manager\IRM_Accounts_20170810_csv.xml " | makemv delim=";" import_File| mvexpand import_File| eval test=replace(import_File,"\\","#") | rex field=test "\S+:#\w+#\w+#(?P<ClientID1>\w+)#\w+#\w+#(?P<filetype>\w+)#(?P\S+)" | eval filetype=if(clientID==clientID1, filetype, "NA")

[woodcock]

I reformatted your OP but some of the text in the rex commands was lost when you submitted it because it was not called out as code. Please fix.

[starcher]

You can stack extractions. It is easier to see in a transforms conf stanza. See in this example of extracting header then pulling from the header field as the source key.

http://www.georgestarcher.com/splunk-bringing-in-data-minecraft-the-model-method/