How to use regex in calculated fields?

[bitnapper]

Hi, I've been told, that using field extractions on json is not best practis and that I should use calculated fields instead. In some cases thats easy and I can use replace or other methods to do that but in some it is more difficult. 

I have some events giving me information about software versions. When I try to extract the version string from as follows, I get the results for events containing this string. In all other cases I get the complete string instead. What I need is the matching string or nothing. I couldn't figure out how to do that.

replace(message, "^My Software Version (\S+).*", "\1") 

[bowesmana · Accepted solution]

Using replace will replace the string if a match is found. If no match is found, it will not replace aything.

You can using "if" statement 

if(match(message, "^My Software Version (\S+).*"), replace(message, "^My Software Version (\S+).*", "\1"), "")

The last "" means that the assigned field will be an empty string, but if you want that field not to exist for that event, then use null() instead

[bitnapper]

Thanks, thats works.

[gcusello]

Hi @bitnapper,

I'd use the rex command in sed mode to do this (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Rex)

something like this:

| rex field=message mode=sed "s/^My Software Version (\S+).*/NA/g"

I'm not sure about the condition, could you share some sample of both data types with the exact substitution you whould have?

Ciao.

Giuseppe

[bitnapper]

Hi @gcusello,

thanks for your reply. I tested the regex with the | rex command. It not that I can't extract the data. I just can't extract it with the calculated field extraction. As far as I understand, everything that works with | eval would work in calculated fields. Thats why I do it with replace in cases where I know that I have a match in every event.