Splunk Search

How to use rex to extract a field that starts with another field value?

pedromvieira
Communicator

Hi.

I'd like to rex a field that starts with another field value.

EX:

****Data

UA=Mozilla/5.0 (Linux; Android 4.0.3; GT-I9100 Build/IML74K) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19
AV=18.0.1025

****Desired

AV2=18.0.1025.166

****Search

| inputlookup VERSION.csv
| rex field=UA "<AV>.(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
1 Solution

somesoni2
Revered Legend

Give this a try

| inputlookup VERSION.csv
| eval UA1=replace(UA,AV.".","MyField=")
| rex field=UA1 "MyField=(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
| fields - UA1

View solution in original post

somesoni2
Revered Legend

Give this a try

| inputlookup VERSION.csv
| eval UA1=replace(UA,AV.".","MyField=")
| rex field=UA1 "MyField=(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
| fields - UA1

pedromvieira
Communicator

Perfect. Thanks.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>