Splunk Search

how to use field value present in one rex into another rex

Chandrasekhar6
Explorer
index=cs |  rex "Type=(?<type>[a-z]+)"
| rex field=AResponse.BResponse.Message mode=sed "s/Ref number+\w+\sfailed on num:*+/NetworkA failed on num: /g"



Here I hardcoded NetworkA  in second rex
but actually its a dynamic value and it should be changed according to value present in field type

How to use type value in second rex 

Labels (1)
Tags (1)
0 Karma
1 Solution

justinatpnnl
Communicator

It seems like you may be able to accomplish what you want with an eval:

index=cs 
| rex "Type=(?<type>[a-z]+)"
| eval AResponse.BResponse.Message = replace('AResponse.BResponse.Message', "Ref number \w+ failed on num: ", type." failed on num: ")

 

View solution in original post

justinatpnnl
Communicator

It seems like you may be able to accomplish what you want with an eval:

index=cs 
| rex "Type=(?<type>[a-z]+)"
| eval AResponse.BResponse.Message = replace('AResponse.BResponse.Message', "Ref number \w+ failed on num: ", type." failed on num: ")

 

Chandrasekhar6
Explorer

Tq so much 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the concatenation operator to include the field from the first regex in the second.

index=cs 
| rex "Type=(?<type>[a-z]+)"
| rex field=AResponse.BResponse.Message mode=sed "s/Ref number+\w+\sfailed on num:*+/" . type . " failed on num: /g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Chandrasekhar6
Explorer

I am getting this error 

Error in 'rex' command: Failed to initialize sed. Failed to parse the replacement string

When I removed double quotes getting this ouput :           . type . failed on num

 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...