I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<UID>\d+(?:\.\d+)+)
as it nicely matches my UID's in forms like 1.2.3454.324234.123.123.1111 etc.
Since there are different type of UIDs in my data I would now like to reuse the UID I defined to extract the UIDs and assign them to a new field, for instance I would like to extract the UID from below and assign it to SOPInstanceUID within the same app:
Processing C-STORE-RQ for SOP Class 'STANDARD_RT_IMAGE' and SOP Instance UID '1.2.246.352.62.1.4620745920092066496.17329666369531438486'
Is it possible to reuse my already defined UID and do something like a regex like this: SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'
You can capture the same thing multiple times like this:
... | rex "(?<UID1>(?<UID2>(?<UID3>(?<UID4>\d+(?:\.\d+)+))))
Yes, just pass the field=
parameter. This will tell Splunk to extract a value from an existing field
| rex field=UID SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'
@jmartens did this help you?