How to create a new field from the content of another field by condition and rex?

[bosch_softtec]

Hi,

I am trying to create a new field "foo" whose content is generated from field "bar", depending on the content of field "bar".
The condition is, if the value "bla" is contained in field "bar", then set the value for "foo" to [rex field=bar "(\ w +) . \ W + $"], otherwise set the value to [rex field=bar "(\ w +) . \ w + $"].

Values from field "bar" looks like:

oud.common.comp.core.nightling.bla
common.comp.core.nightling.protocol
loud.bam.comp.client.news.thrift
oud.bam.comp.client.files.thrift

The values for field "foo" should look like:

bla
nightling
news
files

I tried to set it up with the following search:

... | eval foo=if(match(bar,"bla"),rex field=bar (\w+)\.\w+$],[rex field=bar (\w+)\.\w+$]

The result is:

 Error in 'rex' command: The regex '(\w+)\.\w+$' does not extract anything. It should specify at least one named group. Format: (?<name>...).

It would be nice if someone could help me to find the solution, that it will work.

Thanks in advanced

[bosch_softtec]

Thank you koshyk,

I didn't get your suggestion working, I always get the following error:

Error in 'makeresults' command: This command must be the first command of a search

but it inspired me to change my querry like this:

.... | rex field=bar "(?<foo2>\w+)\.\w+$"
| rex field=bar "(?<foo3>\w+)$"
| eval foo=if(match(bar,"bla"),foo3,foo2)

That works fine for my requirements.

[koshyk]

Splunk requires named group as part of rex

Please try below

|makeresults
| eval bar="bla.lah"
| rex  field=bar "(?<foo2>\w+)\.\w+$"
| rex  field=bar "(?<foo3>\w+)\w+$"
| eval foo=if(match(bar,"bla"),foo2,foo3)

cheers