Splunk Search

How to combine two field extractions into 1 with regex?

kamal_jagga
Contributor

I read in the best practices that if possible, combine two field extractions in to 1. This will improve the efficiency of the system.

But when I tried implementing it, it's not giving satisfactory results for all scenarios.

eg. When the 1st field is blank or space, it's not extracting the 2nd field consistently.

Has anyone else also faced this issue?

Thanks

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey, do it like this and let me know if this is what you like:

extract-aaa = ((?<field1Name>[field1NameRegex])(?<field2Name>[field2NameRegex]))

So if this was my data:

timestamp - datafield1 and datafield2

I might use this:

extract-aaa = (?<field1>(?<=timestamp - ).*(?= and )(?<field2>.*)
0 Karma

jkat54
SplunkTrust
SplunkTrust

my regex doesnt work with my data sample by the way but i'm thinking you might get the point if you know regex well enough.

0 Karma

gcato
Contributor

The regular expression syntax can get a bit complicated when extracting multiple fields under one rex, but it does work. I suggest using a tool like regex101.com to test with your regular expressions to get it right. I find that they usually happily transfer into Splunk once you've got the syntax right.

Here's a run anywhere splunk example that extracts multiple fields using one rex. Note the nesting of fields extractions.

|stats count as foo |eval foo = " la de dah de da" |rex field=foo "^(?: *)(?P<all>(?P<first>[^\s]+) de (?P<middle>[^\s]+) de (?P<last>.+).*)$"

I suggest going to regex101 (or some other regex tool) and playing around. Here's a link to the example above: https://regex101.com/r/iU2zD0/1

Hope this helps.

0 Karma

Murali2888
Communicator

i faced the same issue when combining multiple field extractions under one rex. Though i had a work around to split them into multiple rex, I would like to understand if this is a limitation

0 Karma

ppablo
Retired

Hi @kamal_jagga

I think it'll be best if you include sample data and the regular expression(s) you've tried already for other users to best help you here.

0 Karma

kamal_jagga
Contributor

Following are my 2 Field extractions:

100_cricket : EXTRACT-runs_1     ^.{23}.{23}35.{121}(?P<runs_1>.{1})
100_cricket : EXTRACT-runs_2     ^.{23}.{23}35.{123}(?P<runs_2>.{1})

I would like to combine them to improve efficiency.

100_cricket : EXTRACT-runs_1,runs_2      ^.{23}.{23}35.{123}(?P<runs_1>.{1})?(?P<runs_2>.{1})

But this regex doesn't work if 1st field is blank or junk values.

Kindly advise.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...