Splunk Search

Unable to extract fields through regular expression and combining them into a single field

luv
Explorer

2013-07-09-23.57.30 [SHU1_SCG1_20130913_UJDD]
2013-07-09-23.57.45 [UBH2_SCDXC1_20130913_FDS]
2013-07-09-23.57.56 [HS3_FDR1_20130924_DJUWS]
2013-07-09-23.57.57 [GFD3_FIE1_20130927_AOIS]
2013-07-09-23.58.00 [SHU1_DBXCF1_20130929_KIDD]
2013-07-09-23.58.30 [(null)]
2013-07-09-23.59.12 [(null)]
2013-07-09-23.59.30 [LIFDSDSD1_DFFDFDF1_20131004_IWD]
2013-07-09-23.59.56 [SDJER4_IUEHG1_20131009_SKIW]
2013-08-09-02.58.30 [(null)]
2013-08-09-04.18.40 [OEIFN3_SZXV1_20131013_APOS]
2013-08-09-04.32.50 [OWPOPF2_VJGGG1_20131022_SIWD]

Their arrangement is like [Field1_Feild2_Feild3_Field4] and sometimes the whole event is (null)
Is there any way from which i can extract all the fields(field1,field2,field3,field4) through a single regex and also the null value(null) if it occurs?
Also after extracting all these fields i want to combine them into a single field(Field5) and wanna show them like "Field5=Field1_Field2_Field3_Field4" or just "Field5=(null)" if that's the case

Any advice?

Thanks :slightly_smiling_face:

Tags (2)
1 Solution

somesoni2
Revered Legend

You can use below to extract individual fields and then evaluate combined field.

<base search>| rex field=body "(?i)\[(?P<field1>.*)_(?P<field2>.*)_(?P<field3>.*)_(?P<field4>.*)\]" | eval field5=COALESCE(field1."_".field2."_".field3."_".field4,"(null)")

Update:

To include field5 with values whatever is available.

 <base search>| rex field=_raw "(?i)\[(?P<field1>.*)_(?P<field2>.*)_(?P<field3>.*)_(?P<field4>.*)\]" | rex field=_raw "(?i)\[(?P<field5>.*)\]"

View solution in original post

somesoni2
Revered Legend

You can use below to extract individual fields and then evaluate combined field.

<base search>| rex field=body "(?i)\[(?P<field1>.*)_(?P<field2>.*)_(?P<field3>.*)_(?P<field4>.*)\]" | eval field5=COALESCE(field1."_".field2."_".field3."_".field4,"(null)")

Update:

To include field5 with values whatever is available.

 <base search>| rex field=_raw "(?i)\[(?P<field1>.*)_(?P<field2>.*)_(?P<field3>.*)_(?P<field4>.*)\]" | rex field=_raw "(?i)\[(?P<field5>.*)\]"

somesoni2
Revered Legend

(?P) is for python friendly regular expression (nothing python specific here), I'm used to write my regex like that.

I updated the answer to capture field5 as it is, so we don't have to do concatenation of fields and in case fields not available, it'll take whatever is available.

0 Karma

luv
Explorer

Thanks that worked in my case :slightly_smiling_face:
But i was just wondering what's that (?P) for?
And suppose if that my log has "(null)" "none" "void" etc then?
I thought to capture this also in a field with a regex, you know like an optional field? but it didn't really work. your suggestion did infact helped in my case but what if it was not the case and i had "(null)","none","void" not just "(null)" then?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...