Reuse field extraction in another field extraction/transformation?

[jmartens]

I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<UID>\d+(?:\.\d+)+)
as it nicely matches my UID's in forms like 1.2.3454.324234.123.123.1111 etc.

Since there are different type of UIDs in my data I would now like to reuse the UID I defined to extract the UIDs and assign them to a new field, for instance I would like to extract the UID from below and assign it to SOPInstanceUID within the same app:

Processing C-STORE-RQ for SOP Class 'STANDARD_RT_IMAGE' and SOP Instance UID '1.2.246.352.62.1.4620745920092066496.17329666369531438486'

Is it possible to reuse my already defined UID and do something like a regex like this: SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'

[woodcock]

You can capture the same thing multiple times like this:

... | rex "(?<UID1>(?<UID2>(?<UID3>(?<UID4>\d+(?:\.\d+)+))))

[skoelpin]

Yes, just pass the field= parameter. This will tell Splunk to extract a value from an existing field

| rex field=UID SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'

[skoelpin]

@jmartens did this help you?