Splunk Search

I want rex command to return empty string if no match

jbrenner
Path Finder

Let's say I have the following SPL query.  Ignore the regexes, thery're not important for the example:

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2

 

Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches.  I just want to return an empty string in the field that doesn't match.  Is there a way to do this? Thanks!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"

View solution in original post

jbrenner
Path Finder

Exactly what I needed. Thanks!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

A common approach is to use fillnull.

 

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
| fillnull FIELD1 FIELD2 value=UNSPEC
| stats count by FIELD1, FIELD2
| foreach FIELD1 FIELD2
    [eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]

 

This is a made-up dataset based on your regex.

MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg

The above method gives

FIELD1FIELD2count
  1
 ddd1
bbb 1
bbbddd1

Here is an emulation to produce this data

 

| makeresults format=csv data="MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg"
``` the above emulates
index=abc
```

 

Play with it and compare with real data.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...