Splunk Search

Transforming Field Value with Rex/Regex?

pamcarvalho
Path Finder

Hey!

So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this?

PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow.

Thanks in advance!!

0 Karma
1 Solution

elliotproebstel
Champion

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

View solution in original post

elliotproebstel
Champion

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

pamcarvalho
Path Finder

Yes!! That's it! Thank you!

I had to change a little bit to work though:

"| rex field=FormatSS mode=sed "s/(\w+)/user_id=\"&\" OR/" max_match=0 | nomv FormatSS | rex field=FormatSS mode=sed "s/^/(/ s/OR$/)/" max_match=0"

I was extracting values from mv fields.

0 Karma

elliotproebstel
Champion

Great. Glad I could help!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
These values are static or dynamic?
If static or near, you can put them on a lookip and then use it to filter you search, e.g.
Your_sear h [ | inputlookup my_lookip.csv | fields account ] | table account
In dynamic use a subsearch instead lookup
Your_search [ search secondary_search | dedup 0 account | fields account ] | table account
Bye.
Giuseppe

pamcarvalho
Path Finder

Dynamic, the user puts the users values in a Text Input this way "user1 user2 user3 user4 user5 user6 (.....)" and then I work with it in the dashboard. But thanks anyway!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...