Splunk Search

Transforming Field Value with Rex/Regex?

pamcarvalho
Path Finder

Hey!

So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this?

PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow.

Thanks in advance!!

0 Karma
1 Solution

elliotproebstel
Champion

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

View solution in original post

elliotproebstel
Champion

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

pamcarvalho
Path Finder

Yes!! That's it! Thank you!

I had to change a little bit to work though:

"| rex field=FormatSS mode=sed "s/(\w+)/user_id=\"&\" OR/" max_match=0 | nomv FormatSS | rex field=FormatSS mode=sed "s/^/(/ s/OR$/)/" max_match=0"

I was extracting values from mv fields.

0 Karma

elliotproebstel
Champion

Great. Glad I could help!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
These values are static or dynamic?
If static or near, you can put them on a lookip and then use it to filter you search, e.g.
Your_sear h [ | inputlookup my_lookip.csv | fields account ] | table account
In dynamic use a subsearch instead lookup
Your_search [ search secondary_search | dedup 0 account | fields account ] | table account
Bye.
Giuseppe

pamcarvalho
Path Finder

Dynamic, the user puts the users values in a Text Input this way "user1 user2 user3 user4 user5 user6 (.....)" and then I work with it in the dashboard. But thanks anyway!

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...