I want rex command to return empty string if no match

[jbrenner]

Let's say I have the following SPL query.  Ignore the regexes, thery're not important for the example:

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2

Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches.  I just want to return an empty string in the field that doesn't match.  Is there a way to do this? Thanks!

[jbrenner]

Exactly what I needed. Thanks!

[yuanliu]

A common approach is to use fillnull.

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
| fillnull FIELD1 FIELD2 value=UNSPEC
| stats count by FIELD1, FIELD2
| foreach FIELD1 FIELD2
    [eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]

This is a made-up dataset based on your regex.

MESSAGE

aaabbbcccddd

aaabbbcccdef

aaabccccddd

abcdefg

The above method gives

FIELD1	FIELD2	count
		1
	ddd	1
bbb		1
bbb	ddd	1

Here is an emulation to produce this data

| makeresults format=csv data="MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg"
``` the above emulates
index=abc
```

Play with it and compare with real data.

[ITWhisperer · Accepted solution]

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"