Using OR with rex commands or combining search results

[RVDowning]

I need to perform a search that extracts user ids from unformatted log lines where the user id would be extracted by one of the following rex commands.

Conceptually it would be something like:

sourcetype="LogsPRD" 22CD91CF-C32F-43E0-A8A6-A09F00D0B9F4  
| rex field=_raw "Users\\\(?<xxx>\w*)" 
OR rex field=_raw ": FEDERATED\\\(?<xxx>\w*)" 
OR rex field=_raw "user FEDERATED\\\(?<xxx>\w*)" 
| eval xxx=upper(xxx) | stats values(xxx)

So, it is essentially three searches with the results to be combined. Does this make any sense?

[tfletcher_splun]

The best thing to do would probably be to use props and transforms. If you define each of these rex commands as a REPORT transform you can then specify multiple in your props.conf and the first successful extraction will be used. See that here:

[http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Createandmaintainsearch-timefieldextract...]

In the shortterm you can make the regex more complicated to use it in one.

1

[tfletcher_splun]

argh link isn't taking you to the section of the page, just scroll there, it's the first example, Configuring a field extraction that utilizes multiple field transforms