Splunk Search
Highlighted

How to use rex to extract a field that starts with another field value?

Communicator

Hi.

I'd like to rex a field that starts with another field value.

EX:

****Data

UA=Mozilla/5.0 (Linux; Android 4.0.3; GT-I9100 Build/IML74K) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19
AV=18.0.1025

****Desired

AV2=18.0.1025.166

****Search

| inputlookup VERSION.csv
| rex field=UA "<AV>.(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
Highlighted

Re: How to use rex to extract a field that starts with another field value?

SplunkTrust
SplunkTrust

Give this a try

| inputlookup VERSION.csv
| eval UA1=replace(UA,AV.".","MyField=")
| rex field=UA1 "MyField=(?<AV1>\d+)\s"
| eval AV2=AV+"."+AV1
| eval AV2=if(isnull(AV2),AV,AV2)
| fields - UA1

View solution in original post

Highlighted

Re: How to use rex to extract a field that starts with another field value?

Communicator

Perfect. Thanks.

0 Karma