Hi,
I am trying to create a new field "foo" whose content is generated from field "bar", depending on the content of field "bar".
The condition is, if the value "bla" is contained in field "bar", then set the value for "foo" to [rex field=bar "(\ w +) . \ W + $"], otherwise set the value to [rex field=bar "(\ w +) . \ w + $"].
Values from field "bar" looks like:
oud.common.comp.core.nightling.bla
common.comp.core.nightling.protocol
loud.bam.comp.client.news.thrift
oud.bam.comp.client.files.thrift
The values for field "foo" should look like:
bla
nightling
news
files
I tried to set it up with the following search:
... | eval foo=if(match(bar,"bla"),rex field=bar (\w+)\.\w+$],[rex field=bar (\w+)\.\w+$]
The result is:
Error in 'rex' command: The regex '(\w+)\.\w+$' does not extract anything. It should specify at least one named group. Format: (?<name>...).
It would be nice if someone could help me to find the solution, that it will work.
Thanks in advanced
Thank you koshyk,
I didn't get your suggestion working, I always get the following error:
Error in 'makeresults' command: This command must be the first command of a search
but it inspired me to change my querry like this:
.... | rex field=bar "(?<foo2>\w+)\.\w+$"
| rex field=bar "(?<foo3>\w+)$"
| eval foo=if(match(bar,"bla"),foo3,foo2)
That works fine for my requirements.
Splunk requires named group as part of rex
Please try below
|makeresults
| eval bar="bla.lah"
| rex field=bar "(?<foo2>\w+)\.\w+$"
| rex field=bar "(?<foo3>\w+)\w+$"
| eval foo=if(match(bar,"bla"),foo2,foo3)
cheers