Splunk Search

Use named backreference in the subsequent rex command

Murali2888
Communicator

Hi All,

Can you let me know how we can use a named backreference in the subsequent rex command? That is pass the value of the named backreference to the next rex command.

I am trying something like below which is not providing the desired result.

rex "<tag1>(?P<NamedField1>[^<]+" | rex "<tag2>?(P=NamedField1)</tag2><tag3>(?P<NamedField2>)" | table NamedField2

If someone could point out some documentation around this that would be very helpful.

0 Karma

maciep
Champion

Not exactly what you're asking, but you can use \n to represent a previously captured group in the same rex command. So in your case, something like

rex "<tag1>(?P<NamedField1>[^<]+").+<tag2>\1</tag2><tag3>(?P<NamedField2>)" 

Although I'm pretty sure i found a way to substitute field names in the rex too, but don't remember and could be mistaken.

0 Karma

Murali2888
Communicator

Thanks maciep.

I had this option, but unfortunately the xml structure is quite redundant and complex which would not allow using a single rex command. Nevertheless, I had found some workaround with eval command.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...