Splunk Search

Rex Help with capturing query results as fields

irishmanjb
Path Finder

Hello Splunkers
I am running a query that is essentially returning two possible values in the raw table that I need to capture as fields:

11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified

I want to capture "Customer Accepted Terms" as one field and "Customer Qualified" so I can present those in a chart with some metrics

thanks in advance.

Tags (2)
1 Solution

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

View solution in original post

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

irishmanjb
Path Finder

this is great thanks for your help

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...