Rex Help with capturing query results as fields

[irishmanjb]

Hello Splunkers
I am running a query that is essentially returning two possible values in the raw table that I need to capture as fields:

11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified

I want to capture "Customer Accepted Terms" as one field and "Customer Qualified" so I can present those in a chart with some metrics

thanks in advance.

[darrenfuller · Accepted solution]

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

[irishmanjb]

this is great thanks for your help