Splunk Search

How to create a new field from the content of another field by condition and rex?



I am trying to create a new field "foo" whose content is generated from field "bar", depending on the content of field "bar".
The condition is, if the value "bla" is contained in field "bar", then set the value for "foo" to [rex field=bar "(\ w +) . \ W + $"], otherwise set the value to [rex field=bar "(\ w +) . \ w + $"].

Values from field "bar" looks like:


The values for field "foo" should look like:


I tried to set it up with the following search:

... | eval foo=if(match(bar,"bla"),rex field=bar (\w+)\.\w+$],[rex field=bar (\w+)\.\w+$]

The result is:

 Error in 'rex' command: The regex '(\w+)\.\w+$' does not extract anything. It should specify at least one named group. Format: (?<name>...).

It would be nice if someone could help me to find the solution, that it will work.

Thanks in advanced

0 Karma


Thank you koshyk,

I didn't get your suggestion working, I always get the following error:

Error in 'makeresults' command: This command must be the first command of a search

but it inspired me to change my querry like this:

.... | rex field=bar "(?<foo2>\w+)\.\w+$"
| rex field=bar "(?<foo3>\w+)$"
| eval foo=if(match(bar,"bla"),foo3,foo2)

That works fine for my requirements.

0 Karma

Super Champion

Splunk requires named group as part of rex

Please try below

| eval bar="bla.lah"
| rex  field=bar "(?<foo2>\w+)\.\w+$"
| rex  field=bar "(?<foo3>\w+)\w+$"
| eval foo=if(match(bar,"bla"),foo2,foo3)


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!