Splunk Search

how to use field value present in one rex into another rex

Chandrasekhar6
Explorer
index=cs |  rex "Type=(?<type>[a-z]+)"
| rex field=AResponse.BResponse.Message mode=sed "s/Ref number+\w+\sfailed on num:*+/NetworkA failed on num: /g"



Here I hardcoded NetworkA  in second rex
but actually its a dynamic value and it should be changed according to value present in field type

How to use type value in second rex 

Labels (1)
Tags (1)
0 Karma
1 Solution

justinatpnnl
Communicator

It seems like you may be able to accomplish what you want with an eval:

index=cs 
| rex "Type=(?<type>[a-z]+)"
| eval AResponse.BResponse.Message = replace('AResponse.BResponse.Message', "Ref number \w+ failed on num: ", type." failed on num: ")

 

View solution in original post

justinatpnnl
Communicator

It seems like you may be able to accomplish what you want with an eval:

index=cs 
| rex "Type=(?<type>[a-z]+)"
| eval AResponse.BResponse.Message = replace('AResponse.BResponse.Message', "Ref number \w+ failed on num: ", type." failed on num: ")

 

Chandrasekhar6
Explorer

Tq so much 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the concatenation operator to include the field from the first regex in the second.

index=cs 
| rex "Type=(?<type>[a-z]+)"
| rex field=AResponse.BResponse.Message mode=sed "s/Ref number+\w+\sfailed on num:*+/" . type . " failed on num: /g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Chandrasekhar6
Explorer

I am getting this error 

Error in 'rex' command: Failed to initialize sed. Failed to parse the replacement string

When I removed double quotes getting this ouput :           . type . failed on num

 

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...