How to make comparison of a field with a digit with a field where there are alphabetic characters?

[metylkinandrey]

Prompt as I can make arithmetic comparison of two fields. Comparison: more, less.
The first field consists of numbers: field="1", field="2"
The second of numbers and letters: field="1.route", field="2.route"

[gcusello · Accepted solution]

Hi @metylkinandrey,

if the structure of the second field is fixed, you can use a regex to extract a part of the second field to compare with the first field, something like this:

<your_search>
| rex field=field2 "^(?<field2_num>\d+)\."
| search field1=field2_num

Ciao.

Giuseppe

[metylkinandrey]

Giuseppe, Hello!
I do not quite understand how it works, it gives an error:
error in 'rex' command: The regex '(routepointID)=routepointID2' does not extract anything. It should specify at least one named group. Format: (?<name>...).

What am I doing:
| rex routepointID=routepointID2 "^(?<routepointID2_num>\d+)\."

What I need:
Where: "routepointID": "1.SAPS-SIS.TO.LSP.SEND" or "routepointID": "2.SAPS-SIS.TO.LSP.RECEIVE"

I want to receive: "routepointID2_num": "1" or "routepointID2_num": "1"

[gcusello]

Hi @metylkinandrey,

read again the rex command syntax at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Rex :

| rex field=routepointID "^(?<routepointID_num>\d+)\."

Could youshare a sample of your logs?

I have to understand if you have both the values in the same event or in two different events for the comparison.

Ciao.

Giuseppe

[metylkinandrey]

Giuseppe, within one message, the field can take only one value, either: 1.SAPS-SIS.TO.LSP.SEND, or: "2.SAPS-SIS.TO.LSP.RECEIVE".
I still don't understand what I need
AT:
| rex field=routepointID "^(?<routepointID_num>\d+)\."
What does refer to: field?
Am I doing the right thing if I want to get a new field "routepointIDnum": "1" or "routepointIDnum": "2"
So?
| rex routepointIDnum=routepointID "^(?<routepointID_num>\d+)\."

<routepointID_num> - what should I substitute instead?

[gcusello]

Hi @metylkinandrey,

as you can read in the above link (https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Rex ), in the rex command you can specify a field for regex application,

in other words, if you don't specify any field, the regex is applied to the entire event (_raw),

if instead you specify a field, the regex is appliad, as in your case, only to the specified field.

The meaning of the command I sent you is:

take in the field "routepointID" the number that is at the beginning of the field and put it in a field called "routepointID_num"

In this way, in the routepointID_num field you have the numbers to match.

For this reason you cannot put the condition in the rex command, but you have to put it in the following command.

The questions now are:

• are the two values of routepointID field for field extraction and comparison in the same event or in two different events?
• and, if they are in two events, how can I correlate them? there's a common value in a field (a correlation key)?

Ciao.

Giuseppe

[metylkinandrey]

Giuseppe, thank you!

Figured it out, it worked:

index="main" sourcetype="testsystem-script333"

| rex field=routepointID "^(?<routepointID_num>\d+)\."

| table routepointID_num

[gcusello]

Hi @metylkinandrey,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉