Splunk Search

how to merge multiple rex commands

abhayneilam
Contributor

Hi,

I have a query as follows :

index="maa" |rex field="Location" (?(?i)"delhi") | eval ONE=lower(ONE) |stats count(ONE) by ONE | append [search index="maa" |rex field="Location" | (?(?i)"kol") | eval ONE=lower(ONE) |stats count(ONE) by ONE ] | append [ search index="maa" | rex field="Location" (?(?i)"mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE]

Here, I am using 3 keywords "delhi","kol" and "mumbai" but I have used 3 rex for this..can I merge three into one rex. when I am merging as follows I am getting the correct count for the keywords. Please help

index "maa" | rex field="Locaion" (?(?i)"delhi|kol|mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE

0 Karma

rakesh_498115
Motivator

Hi Abhay..

You can create field aliases for your thress rex fields as location and then you can use the stats count by location like this .

rex field="Location" (?(?i)"delhi")
rex field="Location" | (?(?i)"kol")
rex field="Location" (?(?i)"mumbai")

Now go to Field Aliases and create a common alias for these three fields i.e say location .

Then use your query like this..

index="maa" | stats count by location

Would you give the desired results..

0 Karma

MuS
Legend

the problem is, that in the data multiple city occur at the same line:

abhay|26|koldelhigmumbaiis_delhiood_di
murari|30|ranigang
abc|32|mumbai is delhi place
murari|30|ranigang_kolbabbu is kol
murari|30|delHI is not in kolkata
mno|100|delhi
murari|30|ranig
xyz|100|delhi

abhayneilam want to match only ONE city per line, either delhi, kol or mumbai.
I cannot create any regex matching this pattern on gskinner....sorry but on the other hand I'm no regex expert after all 🙂

0 Karma

bmacias84
Champion

Why not combine them into one rex statement with multiple ability to match multiple times.


rex field="Location"(?(?im)"(delhi|mumbai|kol)")

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...