Splunk Search

Using OR with rex commands or combining search results


I need to perform a search that extracts user ids from unformatted log lines where the user id would be extracted by one of the following rex commands.

Conceptually it would be something like:

sourcetype="LogsPRD" 22CD91CF-C32F-43E0-A8A6-A09F00D0B9F4  
| rex field=_raw "Users\\\(?<xxx>\w*)" 
OR rex field=_raw ": FEDERATED\\\(?<xxx>\w*)" 
OR rex field=_raw "user FEDERATED\\\(?<xxx>\w*)" 
| eval xxx=upper(xxx) | stats values(xxx)

So, it is essentially three searches with the results to be combined. Does this make any sense?

Splunk Employee
Splunk Employee

The best thing to do would probably be to use props and transforms. If you define each of these rex commands as a REPORT transform you can then specify multiple in your props.conf and the first successful extraction will be used. See that here:


In the shortterm you can make the regex more complicated to use it in one.


0 Karma

Splunk Employee
Splunk Employee

argh link isn't taking you to the section of the page, just scroll there, it's the first example, Configuring a field extraction that utilizes multiple field transforms

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.