Splunk Search

REX Extract and/or separate a single field into 1 or 2 fields based on different patterns

sh254087
Communicator

Need to extract or split a filed value into different fields based on a condition/irregular pattern(or however it can be called).

Attached is what I tried but it did not work.

Expected output:
MeterName field should be separted into one or two fields based on the field value and pattern. / works as a separator wherever exixts. The text "Low Priority" if exists, should be ignored.

Possible source field value patterns and Expected extraction output :
Pattern 1 : "single alphanumeric word" = Should be MeterName1
Pattern 2: "multiple alphanumeric words separated by space" = MeterName1
Pattern 3 : "single alphanumeric word" -space- Low priority = MeterName1 (while "* -space- Low priority*" ignored)
Pattern 4: "multiple alphanumeric words separated by space" -space- Low priority = MeterName1 (while "-space- Low priority" ignored)
Pattern 5 : "single alphanumeric word or multiple words separated by space" / "single alphanumeric word or multiple words separated by space" = MeterName1 / MeterName2
Pattern 6 : "single alphanumeric word or multiple words separated by space" / "single alphanumeric word or multiple words separated by space" -space- Low priority = MeterName1 / MeterName2 (while "-space- Low priority" ignored)

Tried few other but again not the required output:
| rex field=MeterName "^(?\w+\s\w+)\/(?\w+).*$"
= > Matched only one entry, with result - MeterName = E20 v3/E20s v3 Low Priority MeterName1 =E20 v3 MeterName2 = E20s

| rex field=MeterName "^(?\w+\s\w+)\/(?\w+.*)$"
= > Matched only one entry, with result - MeterName = E20 v3/E20s v3 Low Priority MeterName1 =E20 v3 MeterName2 = E20s v3 Low PriorityWrong REX and different results

Can someone please help me achieve the expected result?

0 Karma

woodcock
Esteemed Legend

Nobody is going to be able to help you when you post pictures. We need text so that we can work with it in our Splunk Search Heads.

0 Karma

sh254087
Communicator

While trying around, I finally found a way of putting rex commands in multiple different formats that together served my requirement. However, I feel it may not be the right way of writing it. Hence please help me fine tune and reduce/optimize the code.

Here's the code and the output:

Possible Temporary REX solution

0 Karma

woodcock
Esteemed Legend

If you are doing RegEx on the same source filed, then you can do this:

... | rex field=foo "(?:RegEx1)|(?:RegEx2)|(?:RegEx3)|(?:RegEx4)|(?:RegEx5)|(?:RegEx6)"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...