Splunk Search

Rex for a field with varying number of values

BinnyK
Explorer

I have some values in a fied which are email addresses.

eg: Values of F may be
"[""email_type2@gmail.com""]"
"[""email_type1@gmail.com"",""email_type2@hotmail.com""]"
"[""email_type1@live.com"",""email_type2@aol.com"",""email_type3@outlook.com""]"

The field F may have 1, 2 or 3 values. If there is only 1 value, it is going to be email_type2, if there are 2 values it will be email_type1 followed by email_type2 and if there are going to be 3 values, it is going to be email_type1 followed by email_type2 and email_type3.

I need to extract 3 fields, type1, type2 and type3 and include those values in the extracted fields. Can someone help me with this?

Tags (2)
0 Karma

BinnyK
Explorer

I created some complex regex, but solved it.

rex field=F "[\"(?.)\",\"(?.)\",\"(?.*)\"]" | rex field=F "[\"(?[^,]+)\",[^,]+]" | rex field=F "[\"[^,]+\",\"(?[^,]+)\"]" | rex field=F "[\"(?[^,]+)\"]"

0 Karma

somesoni2
Revered Legend

Give this a try

your base search | eval email_type1=mvindex(split(F,","),0) | eval email_type2=mvindex(split(F,","),1) | eval email_type3=mvindex(split(F,","),2)

The value of fields email_type2 and email_type3 will be null for events where they are not available. There may be more value cleanup required, so run the above query and paste the results (if you need cleanup).

0 Karma

somesoni2
Revered Legend

Is the max number of emails that field F can have is fixed (e.g. 3 as per example)??

0 Karma

BinnyK
Explorer

It can be from 1 to 3.
I can easily use rex to extract fields if it was a fixed number of elements inside. I cant work out a good regex for varying number of elements in each log's F field

0 Karma

sundareshr
Legend

Try this

... | rex field=F max_match=0 "\"\"(?<em>[^@]+@[^\"]+)\"" | mvexpand em | ...
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...