Splunk Search

How to use regex in calculated fields?

bitnapper
Explorer

Hi, I've been told, that using field extractions on json is not best practis and that I should use calculated fields instead. In some cases thats easy and I can use replace or other methods to do that but in some it is more difficult. 

I have some events giving me information about software versions. When I try to extract the version string from as follows, I get the results for events containing this string. In all other cases I get the complete string instead. What I need is the matching string or nothing. I couldn't figure out how to do that.

replace(message, "^My Software Version (\S+).*", "\1") 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Using replace will replace the string if a match is found. If no match is found, it will not replace aything.

You can using "if" statement 

if(match(message, "^My Software Version (\S+).*"), replace(message, "^My Software Version (\S+).*", "\1"), "")

The last "" means that the assigned field will be an empty string, but if you want that field not to exist for that event, then use null() instead

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Using replace will replace the string if a match is found. If no match is found, it will not replace aything.

You can using "if" statement 

if(match(message, "^My Software Version (\S+).*"), replace(message, "^My Software Version (\S+).*", "\1"), "")

The last "" means that the assigned field will be an empty string, but if you want that field not to exist for that event, then use null() instead

bitnapper
Explorer

Thanks, thats works.

0 Karma

gcusello
Esteemed Legend

Hi @bitnapper,

I'd use the rex command in sed mode to do this (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Rex)

something like this:

| rex field=message mode=sed "s/^My Software Version (\S+).*/NA/g"

I'm not sure about the condition, could you share some sample of both data types with the exact substitution you whould have?

Ciao.

Giuseppe

0 Karma

bitnapper
Explorer

Hi @gcusello,

thanks for your reply. I tested the regex with the | rex command. It not that I can't extract the data. I just can't extract it with the calculated field extraction. As far as I understand, everything that works with | eval would work in calculated fields. Thats why I do it with replace in cases where I know that I have a match in every event.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...