Regex for fields that may or not be filled?

[mrgibbon]

Hey Guys, tricky one I came across.
I have to find and match on fields that may not be present.
So far I have this to find the fields when they exist:

"Source computer: (?P[^,]+) ,Source IP: (?P[^,]+)"

But it fails when the field is not filled and just looks like this:
"Source computer: " or "Source IP: ".
In fact the whole thing can look like this:
"Source computer: ,Source IP: ,"

How can I overcome this and maybe insert a "null" or "missing" string if the field is empty?
Ive tried with no success:
| fillnull value="missing" sourcecomputer
| fillnull value=NULL sourcecomputer

Anyone? Thanks in advance.

[mrgibbon]

Answered my own question, using * and not + at the end of the search.

[Rob]

You may want to try using an eval statement such as;

|eval sourcecomputer=if(sourcecomputer=="", "missing", sourcecomputer)

This will rewrite your field that has an empty value (not exactly NULL) and replace it with missing and otherwise replace it with whatever is already in the sourcecomputer field.

That will work for one value at a time, otherwise, you may want to use the sed mode to replace empty values in your raw string.

|rex field=_raw mode=sed "s/:\s,/:\smissing,/g"