Splunk Search

I want rex command to return empty string if no match

jbrenner
Path Finder

Let's say I have the following SPL query.  Ignore the regexes, thery're not important for the example:

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
stats count by FIELD1, FIELD2

 

Right now, the query doesn't return a result unless both fields match, but I still want to return a result if only one field matches.  I just want to return an empty string in the field that doesn't match.  Is there a way to do this? Thanks!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"

View solution in original post

jbrenner
Path Finder

Exactly what I needed. Thanks!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

A common approach is to use fillnull.

 

index=abc
| rex field=MESSAGE "aaa(?<FIELD1>bbb)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd)"
| fillnull FIELD1 FIELD2 value=UNSPEC
| stats count by FIELD1, FIELD2
| foreach FIELD1 FIELD2
    [eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]

 

This is a made-up dataset based on your regex.

MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg

The above method gives

FIELD1FIELD2count
  1
 ddd1
bbb 1
bbbddd1

Here is an emulation to produce this data

 

| makeresults format=csv data="MESSAGE
aaabbbcccddd
aaabbbcccdef
aaabccccddd
abcdefg"
``` the above emulates
index=abc
```

 

Play with it and compare with real data.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use an empty alternative

| rex field=MESSAGE "aaa(?<FIELD1>bbb|)" 
| rex field=MESSAGE "ccc(?<FIELD2>ddd|)"
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...