Splunk Search

Nested Field Extraction

psharkey
Explorer

I have extracted a field that contains two values separated by a dash character "-". Now I want to retain that field/value as well as splitting its value into two additional fields.

For example:

combined_field = "1A-1B" (or src_zone-dst_zone)

src_zone = "1A" (one or more numbers followed by a single letter)

dst_zone = "1B" (one or more numbers followed by a single letter)

This rex worked (?< combined_field>[^\t]+) for capturing combined_field = "1A-1B".

(fields are tab separated)

This rex worked (?< combined_field>(?< src_zone>\d+\w+)[^\t]+) for capturing both combined_field = "1A-1B" and src_zone = "1A".

However, this rex (?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>\d+\w+)[^\t]+) fails to capture src_zone or dst_zone.

How can I revise this rex to capture the combined_field in its entirety, src_zone and dst_zone?

Thanks,
Patrick

Tags (1)
0 Karma
1 Solution

psharkey
Explorer

After some experimentation I arrived at a solution:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]+))\t+

Yielded the desired results:

combined_field = "1A-1B"

src_zone = "1A"

dst_zone = "1B"

Thanks for your help.

View solution in original post

psharkey
Explorer

After some experimentation I arrived at a solution:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]+))\t+

Yielded the desired results:

combined_field = "1A-1B"

src_zone = "1A"

dst_zone = "1B"

Thanks for your help.

somesoni2
Revered Legend

Try this

your base search  | rex field=yourfield "(?<combined>(?<src_zone>.*)[\-](?<dst_zone>[^t]+))"

If you're not keen on doing everything in one rex command only, there are multiple options.

your base search  | rex field=yourfield "(?<combined_field>[^t]+)" | rex field=combined_field  "(?<src_zone>.*)[\-](?<dst_zone>.*)"


 your base search  | rex field=yourfield "(?<src_zone>.*)[\-](?<dst_zone>.*)[t]+" | eval combined_field= src_zone."-".dst_zone
0 Karma

psharkey
Explorer

I should have specified that there are additional tab separated fields after combined_field. When I attempted your first suggestion it captured more than I wanted.

However, I am getting closer using a variation on your first suggestion:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]))[^\t]+

yields

combined_field = "1A-1"

src_zone = "1A"

dst_zone = "1"

combined_field and dst_zone are getting clipped by one character.

Any more suggestions?

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...