Let's say I have the following SPL query. Ignore the regexes, thery're not important for the example:
index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)"
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2
Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches. I just want to return an empty string in the field that doesn't match. Is there a way to do this? Thanks!
Use an empty alternative
| rex field=MESSAGE "aaa(?<FIELD1>bbb|)"
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"
Exactly what I needed. Thanks!
A common approach is to use fillnull.
index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)"
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
| fillnull FIELD1 FIELD2 value=UNSPEC
| stats count by FIELD1, FIELD2
| foreach FIELD1 FIELD2
[eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]
This is a made-up dataset based on your regex.
| MESSAGE |
| aaabbbcccddd |
| aaabbbcccdef |
| aaabccccddd |
| abcdefg |
The above method gives
| FIELD1 | FIELD2 | count |
| 1 | ||
| ddd | 1 | |
| bbb | 1 | |
| bbb | ddd | 1 |
Here is an emulation to produce this data
| makeresults format=csv data="MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg"
``` the above emulates
index=abc
```
Play with it and compare with real data.
Use an empty alternative
| rex field=MESSAGE "aaa(?<FIELD1>bbb|)"
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"