How to extract values from existing field and reassign them to field?

[wts408]

Hello,

I currently have a field that contains a long string over 100+ events and in that field there are varying file sizes (609.9 KB, 1GB, 300B, etc.). What I would like to do is come up with an eval or rex command that will pull out only the file sizes and place them into a new field called File_Size. I tried using the field extractor via the GUI, but it would only pick up a couple of the file sizes and even then still wouldn’t show up in the available fields of my search. I’ve also tried creating different queries, but can’t seem to get capture groups set correctly. Can someone please advise on best approach?

[gcusello]

Hi @wts408,

you could extract the field using the regex and then use the eval coalesce, something like this:

<your_search>
| rex field=File_Size "..File_Size1.."
| eval File_Size=coalesce(File_Size1,File_Size)
| ...

Ciao.

Giuseppe

[wts408]

@gcusello - so where you say “..File_Size1..” I should put one of the actual file sizes there? I’ve tried that, but I just get an error saying the regex “xyz” does not extract anything. It should specify at least one named group. Format: (?<name>..). Thoughts?

[gcusello]

Hi @wts408,

Sorry I wasn't so clear!

I haven't your logs so I cannot give you the correct regex to use.

With my answer I  was saying: make a regex extraction using a different name for the extracted field File_Size1, so you can use it in the following coalesce command.

Ciao.

Giuseppe

[wts408 · Accepted solution]

@gcusello - I did some tinkering and came up with the solution! 

mysearch... | rex field=_raw "FileSize: (?<File_Size>\d*.\d*\s*\w*)"

This gave me what I was looking for, which captured all of the different file sizes and the corresponding units (MB, GB, etc.).

Thanks for pointing me in the right direction!!

[gcusello]

Hi @wts408,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉