Splunk Search

I want rex command to return empty string if no match

jbrenner
Path Finder

Let's say I have the following SPL query.  Ignore the regexes, thery're not important for the example:

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2

 

Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches.  I just want to return an empty string in the field that doesn't match.  Is there a way to do this? Thanks!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"

View solution in original post

jbrenner
Path Finder

Exactly what I needed. Thanks!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

A common approach is to use fillnull.

 

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
| fillnull FIELD1 FIELD2 value=UNSPEC
| stats count by FIELD1, FIELD2
| foreach FIELD1 FIELD2
    [eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]

 

This is a made-up dataset based on your regex.

MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg

The above method gives

FIELD1FIELD2count
  1
 ddd1
bbb 1
bbbddd1

Here is an emulation to produce this data

 

| makeresults format=csv data="MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg"
``` the above emulates
index=abc
```

 

Play with it and compare with real data.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...