Splunk Search

How to use regex on field names?

tamakg
Path Finder

For example.

Is there any way to convert this:

alt text

into this?

Don't care about the numbers but the value of the second column (new) is a substr of the previous headers. Of course there are many other different "Disks".

alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

View solution in original post

somesoni2
Revered Legend

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

View solution in original post

tamakg
Path Finder

Almost there. Missing the "removed field prefix" as a new column value.

0 Karma

somesoni2
Revered Legend

I didn't understand. What are you getting now and what's expected?

0 Karma

jodyfsu
Path Finder

If you can provide a sample event we can probably figure this out.

0 Karma

tamakg
Path Finder
0 Karma

jodyfsu
Path Finder
| rex field=PhysicalDisk_0_C_Avg__Disk_Bytes_Read "(?<DRIVE>\w+\_\d\_\w)\_(?<AVDBR>.[^\s]+)"
0 Karma

jodyfsu
Path Finder

See if that works.

0 Karma

tamakg
Path Finder

Nope. New fields are empty...

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.