Transforming Field Value with Rex/Regex?

[pamcarvalho]

Hey!

So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this?

PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow.

Thanks in advance!!

[elliotproebstel · Accepted solution]

I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""

It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"

[pamcarvalho]

Yes!! That's it! Thank you!

I had to change a little bit to work though:

"| rex field=FormatSS mode=sed "s/(\w+)/user_id=\"&\" OR/" max_match=0 | nomv FormatSS | rex field=FormatSS mode=sed "s/^/(/ s/OR$/)/" max_match=0"

I was extracting values from mv fields.

[elliotproebstel]

Great. Glad I could help!

[gcusello]

Hi
These values are static or dynamic?
If static or near, you can put them on a lookip and then use it to filter you search, e.g.
Your_sear h [ | inputlookup my_lookip.csv | fields account ] | table account
In dynamic use a subsearch instead lookup
Your_search [ search secondary_search | dedup 0 account | fields account ] | table account
Bye.
Giuseppe

[pamcarvalho]

Dynamic, the user puts the users values in a Text Input this way "user1 user2 user3 user4 user5 user6 (.....)" and then I work with it in the dashboard. But thanks anyway!