Building for the Splunk Platform

rex with datamodel

sarit_s
Communicator

Hello

i'm wondering if it is possible to use rex command with datamodel without declaring attributes for every rex field i want (i have lots of them )

 

thanks

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please say more about what you want to do.  Do you want to use the rex command inside a datamodel or use the rex command on the results returned by a DM?

If the former then you don't need rex.  When you add a field to the DM, choose "regular expression" and enter your regex string.  The fields you define in the regex (using named capture groups) will become fields in the DM.

If the latter then, yes, you can.

Be aware that more fields in a DM equates to more storage needed to store the results if the DM is accelerated.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sarit_s
Communicator

Hello @richgalloway 

thanks for your reply

yes, im referring to the second option. 

can you show me an example of how can i do it ?

 

thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One you have results from the datamodel, use the rex command on those results the same way you would use it on any other result set.  You will not have a _raw field so the rex command must specify a field name

---
If this reply helps you, Karma would be appreciated.
0 Karma

sarit_s
Communicator

yeah, so, i need the rex to run with _raw
for example :

 

rex field=_raw "TTY=(?<dstuser>.*) ; PWD=(?<url>.*); USER=(?<srcuser>.*) ; COMMAND=(?<status>.*)" | where isnotnull(dstuser) 

 

what replacing the _raw after the datamodel is working ?

 

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...