Splunk Search

Reuse field extraction in another field extraction/transformation?

jmartens
Path Finder

I am looking for a solution to extract certain types of UIDs and therefore defined a basic UID field extraction: (?<UID>\d+(?:\.\d+)+)
as it nicely matches my UID's in forms like 1.2.3454.324234.123.123.1111 etc.

Since there are different type of UIDs in my data I would now like to reuse the UID I defined to extract the UIDs and assign them to a new field, for instance I would like to extract the UID from below and assign it to SOPInstanceUID within the same app:

Processing C-STORE-RQ for SOP Class 'STANDARD_RT_IMAGE' and SOP Instance UID '1.2.246.352.62.1.4620745920092066496.17329666369531438486'

Is it possible to reuse my already defined UID and do something like a regex like this: SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'

0 Karma

woodcock
Esteemed Legend

You can capture the same thing multiple times like this:

... | rex "(?<UID1>(?<UID2>(?<UID3>(?<UID4>\d+(?:\.\d+)+))))
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yes, just pass the field= parameter. This will tell Splunk to extract a value from an existing field

| rex field=UID SOP\sInstance\sUID\s\'(?<SOPInstanceUID>UID)'
0 Karma

skoelpin
SplunkTrust
SplunkTrust

@jmartens did this help you?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...