Splunk Search
Highlighted

How to run a different rex extraction only if another rex extraction did not find anything to extract?

Path Finder

Hi all,

So I'm currently using this extraction:

| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" 

However I have found that this is not always present in my data, so I was wondering if there was a way where I could run this (below) rex command only when the first one doesn't find anything?

 "| rex "(?m)(?:\n|.)MS:(?<MS>\s+\S+)"

Thank you.

0 Karma
Highlighted

Re: How to run a different rex extraction only if another rex extraction did not find anything to extract?

SplunkTrust
SplunkTrust

Can you provide some sample logs for both patterns?
One dirty workaround would be like this

| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" | rex "(?m)(?:\n|.)MS:(?<MS1>\s+\S+)" | eval MS=coalesce(MS,MS1)

View solution in original post

Highlighted

Re: How to run a different rex extraction only if another rex extraction did not find anything to extract?

Path Finder

That worked great! thank you

0 Karma
Highlighted

Re: How to run a different rex extraction only if another rex extraction did not find anything to extract?

Path Finder

If you would like to convert it as an answer I'll accept it for you

0 Karma
Highlighted

Re: How to run a different rex extraction only if another rex extraction did not find anything to extract?

SplunkTrust
SplunkTrust

Here you go.

0 Karma