Splunk Search

How do I select first and second match as separate fields using Rex?

aherrington
Path Finder

Hello,

I have 1 field in Splunk which contains 2 short email headers in plain-text, for example:

 **From**: Me (me@me.com)
 **Sent**: 28 September 2018 17:42
 **To**: You (you@you.com)
 **Subject**: This is the first email

 **From**: Me (me@me.com)
 **Sent**: 28 September 2018 18:42
 **To**: You-aswell (you-aswell@you.com)
 **Subject**: This is the second email

 There is more text after the 2 short email headers.

I would like to use Rex to select the 2 Sent times, i.e:

rex field=output "Sent: (?<sent_time_1>.*)"

rex field=output "Sent: (?<sent_time_2>.*)"

How do I select in the rex function which match to select? As an FYI, there may be text before the headers so selecting the line number wouldn't be an option.

Thanks,

Tags (2)
0 Karma
1 Solution

Sukisen1981
Champion

why not just use something like this?
| rex field=output "Sent: (?.*)" max_match=0
This will give you both the matches in a multivalue value, if you need them as separate rows just append |mvexpand sent_time after the max_match=0

View solution in original post

Sukisen1981
Champion

why not just use something like this?
| rex field=output "Sent: (?.*)" max_match=0
This will give you both the matches in a multivalue value, if you need them as separate rows just append |mvexpand sent_time after the max_match=0

View solution in original post

aherrington
Path Finder

Thanks for your answer, that works to get the result on different rows, however I need the result to be in separate fields.

Can this method be adapted for that?

Thanks,

darrenfuller
Contributor

If it's always two, you could do this...,

| makeresults | eval output="From: Me (me@me.com)
Sent: 28 September 2018 17:42
To: You (you@you.com)
Subject: This is the first email

From: Me (me@me.com)
Sent: 28 September 2018 18:42
To: You-aswell (you-aswell@you.com)
Subject: This is the second email
There is more stuff after the email headers, so this here represents more stuff"
| rex field=output "**Sent**:\s(?\d+\s\w+\s\d+\s\d+:\d+)" max_match=0
| eval sent_time_1=mvindex(sent_time, 0)
| eval sent_time_2=mvindex(sent_time, 1)
| table output sent_time_1, sent_time_2

0 Karma

aherrington
Path Finder

That almost works, although I can't guarantee that there will always be 2, sometimes there will be 3 or 4. I need to make sure it only selects the first 2.

0 Karma

Sukisen1981
Champion

Hi,
mvindex will still work, ref documentation here - http://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/MultivalueEvalFunctions

As the documentation says, mvindex starts from 0 and as @darrenfuller has stated, irrespective of 3-4..n matches in your output field for the above rex, mvindex of 0 and 1 are going to fetch the 1st and 2nd fields respectively.
Can you please try and confirm?

0 Karma

aherrington
Path Finder

Hello, apologies it was an error from a different function that threw up the error. This worked perfectly, thank you for your help

0 Karma