Splunk Search

how to merge multiple rex commands

abhayneilam
Contributor

Hi,

I have a query as follows :

index="maa" |rex field="Location" (?(?i)"delhi") | eval ONE=lower(ONE) |stats count(ONE) by ONE | append [search index="maa" |rex field="Location" | (?(?i)"kol") | eval ONE=lower(ONE) |stats count(ONE) by ONE ] | append [ search index="maa" | rex field="Location" (?(?i)"mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE]

Here, I am using 3 keywords "delhi","kol" and "mumbai" but I have used 3 rex for this..can I merge three into one rex. when I am merging as follows I am getting the correct count for the keywords. Please help

index "maa" | rex field="Locaion" (?(?i)"delhi|kol|mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE

0 Karma

rakesh_498115
Motivator

Hi Abhay..

You can create field aliases for your thress rex fields as location and then you can use the stats count by location like this .

rex field="Location" (?(?i)"delhi")
rex field="Location" | (?(?i)"kol")
rex field="Location" (?(?i)"mumbai")

Now go to Field Aliases and create a common alias for these three fields i.e say location .

Then use your query like this..

index="maa" | stats count by location

Would you give the desired results..

0 Karma

MuS
Legend

the problem is, that in the data multiple city occur at the same line:

abhay|26|koldelhigmumbaiis_delhiood_di
murari|30|ranigang
abc|32|mumbai is delhi place
murari|30|ranigang_kolbabbu is kol
murari|30|delHI is not in kolkata
mno|100|delhi
murari|30|ranig
xyz|100|delhi

abhayneilam want to match only ONE city per line, either delhi, kol or mumbai.
I cannot create any regex matching this pattern on gskinner....sorry but on the other hand I'm no regex expert after all 🙂

0 Karma

bmacias84
Champion

Why not combine them into one rex statement with multiple ability to match multiple times.


rex field="Location"(?(?im)"(delhi|mumbai|kol)")

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...