Splunk Search

How to extract the single field with the multiple values?

marisstella
Explorer

Hiiii
How to extract the single field with multiple values?
Like status is active, failed, cancelled, deactivated, forwarded, reversed
I have created a regex but it is only looking for active not for remaining status...

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

I used your data to formulate a sample test.

   | rex field=a "newstp - (?<status>\S*)

Tell me if this works

View solution in original post

tiagofbmm
Influencer
| rex field=a "\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\"\;\"(?<field1>[^\"]*)\"\;\"(?<field2>[^\"]*)\"\;\".*\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\"\;\"\d*\"\;\"(?<field3>[^\"]*)"
0 Karma

marisstella
Explorer

Hiii tiagofbmm,
I posted a new query, I didn't get a correct response from anyone.. I hope, you will answer to my query..
I have created the fields like A B C.... Now I want to merge A and B fields by creating new field...
Like D=A+B... Can I get any idea on this???

I tried doing this like | eval report= A. "-" .B this is working but we can't run SPL Query everytime...

0 Karma

tiagofbmm
Influencer

I used your data to formulate a sample test.

   | rex field=a "newstp - (?<status>\S*)

Tell me if this works

View solution in original post

marisstella
Explorer

If you don't mind can you also help on more two fields?

0 Karma

tiagofbmm
Influencer

shoot, I'll help if I can

0 Karma

tiagofbmm
Influencer

could you paste here a sample of the data you're looking at?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!