Splunk Search

How to use regex on field names?

tamakg
Path Finder

For example.

Is there any way to convert this:

alt text

into this?

Don't care about the numbers but the value of the second column (new) is a substr of the previous headers. Of course there are many other different "Disks".

alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

View solution in original post

somesoni2
Revered Legend

Try like this

your current search giving table in first screenshot
| untable _time fieldname fieldval
| eval fieldname=replace(fieldname,"^(.+_)(Avg_.+)","\2") 
| xyseries _time fieldname fieldval

If above works for you, look at definition of untable/xyseries command here, to understand the usage better:
http://docs.splunk.com/Documentation/SplunkLight/7.1.2/References/Listofsearchcommands

tamakg
Path Finder

Almost there. Missing the "removed field prefix" as a new column value.

0 Karma

somesoni2
Revered Legend

I didn't understand. What are you getting now and what's expected?

0 Karma

jodyfsu
Path Finder

If you can provide a sample event we can probably figure this out.

0 Karma

tamakg
Path Finder
0 Karma

jodyfsu
Path Finder
| rex field=PhysicalDisk_0_C_Avg__Disk_Bytes_Read "(?<DRIVE>\w+\_\d\_\w)\_(?<AVDBR>.[^\s]+)"
0 Karma

jodyfsu
Path Finder

See if that works.

0 Karma

tamakg
Path Finder

Nope. New fields are empty...

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...