Splunk Search

Nested Field Extraction

psharkey
Explorer

I have extracted a field that contains two values separated by a dash character "-". Now I want to retain that field/value as well as splitting its value into two additional fields.

For example:

combined_field = "1A-1B" (or src_zone-dst_zone)

src_zone = "1A" (one or more numbers followed by a single letter)

dst_zone = "1B" (one or more numbers followed by a single letter)

This rex worked (?< combined_field>[^\t]+) for capturing combined_field = "1A-1B".

(fields are tab separated)

This rex worked (?< combined_field>(?< src_zone>\d+\w+)[^\t]+) for capturing both combined_field = "1A-1B" and src_zone = "1A".

However, this rex (?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>\d+\w+)[^\t]+) fails to capture src_zone or dst_zone.

How can I revise this rex to capture the combined_field in its entirety, src_zone and dst_zone?

Thanks,
Patrick

Tags (1)
0 Karma
1 Solution

psharkey
Explorer

After some experimentation I arrived at a solution:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]+))\t+

Yielded the desired results:

combined_field = "1A-1B"

src_zone = "1A"

dst_zone = "1B"

Thanks for your help.

View solution in original post

psharkey
Explorer

After some experimentation I arrived at a solution:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]+))\t+

Yielded the desired results:

combined_field = "1A-1B"

src_zone = "1A"

dst_zone = "1B"

Thanks for your help.

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search  | rex field=yourfield "(?<combined>(?<src_zone>.*)[\-](?<dst_zone>[^t]+))"

If you're not keen on doing everything in one rex command only, there are multiple options.

your base search  | rex field=yourfield "(?<combined_field>[^t]+)" | rex field=combined_field  "(?<src_zone>.*)[\-](?<dst_zone>.*)"


 your base search  | rex field=yourfield "(?<src_zone>.*)[\-](?<dst_zone>.*)[t]+" | eval combined_field= src_zone."-".dst_zone
0 Karma

psharkey
Explorer

I should have specified that there are additional tab separated fields after combined_field. When I attempted your first suggestion it captured more than I wanted.

However, I am getting closer using a variation on your first suggestion:

(?< combined_field>(?< src_zone>\d+\w+)[\-](?< dst_zone>[^\t]))[^\t]+

yields

combined_field = "1A-1"

src_zone = "1A"

dst_zone = "1"

combined_field and dst_zone are getting clipped by one character.

Any more suggestions?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...