Splunk Search

Rex Help with capturing query results as fields

irishmanjb
Path Finder

Hello Splunkers
I am running a query that is essentially returning two possible values in the raw table that I need to capture as fields:

11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified

I want to capture "Customer Accepted Terms" as one field and "Customer Qualified" so I can present those in a chart with some metrics

thanks in advance.

Tags (2)
1 Solution

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

View solution in original post

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

irishmanjb
Path Finder

this is great thanks for your help

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...