I'm trying to apply a regular expression on input, if regex is not matched I'd like to return a static text as a field value (NULL for example). Splunk 4.3.7.
My current query looks like this, but this would return anything only if all rexes are matched, in example below just first line would work.
Any suggestions how can I get it working?
... | rex "Name=(?
Input:
Some random text; Name=Ruby; Age=18; yada yada; Weight=50
Some random text; Name=Bon; Age=19;
Some random text; Age=18; yada yada; Weight=52
Desired output
Name,Age,Weight
Ruby,18,50
Bon,19,NULL
NULL,18,52
Try this
your base search | rex "Name=(?<name>\w+)" | rex "Age=?(?<age>\w+)" | rex "Weight=?(?<weight>\w+)" | fillnull value=NULL
Try this
your base search | rex "Name=(?<name>\w+)" | rex "Age=?(?<age>\w+)" | rex "Weight=?(?<weight>\w+)" | fillnull value=NULL