Splunk Search

How to extract the single field with the multiple values?

marisstella
Explorer

Hiiii
How to extract the single field with multiple values?
Like status is active, failed, cancelled, deactivated, forwarded, reversed
I have created a regex but it is only looking for active not for remaining status...

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

I used your data to formulate a sample test.

   | rex field=a "newstp - (?<status>\S*)

Tell me if this works

View solution in original post

tiagofbmm
Influencer
| rex field=a "\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\"\;\"(?<field1>[^\"]*)\"\;\"(?<field2>[^\"]*)\"\;\".*\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\"\;\"\d*\"\;\"(?<field3>[^\"]*)"
0 Karma

marisstella
Explorer

Hiii tiagofbmm,
I posted a new query, I didn't get a correct response from anyone.. I hope, you will answer to my query..
I have created the fields like A B C.... Now I want to merge A and B fields by creating new field...
Like D=A+B... Can I get any idea on this???

I tried doing this like | eval report= A. "-" .B this is working but we can't run SPL Query everytime...

0 Karma

tiagofbmm
Influencer

I used your data to formulate a sample test.

   | rex field=a "newstp - (?<status>\S*)

Tell me if this works

marisstella
Explorer

If you don't mind can you also help on more two fields?

0 Karma

tiagofbmm
Influencer

shoot, I'll help if I can

0 Karma

tiagofbmm
Influencer

could you paste here a sample of the data you're looking at?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...