Splunk Search

How to pass a field as a parameter to the rex command?

Murali2888
Communicator

Hi,

I would like to how we can pass a field as a parameter to the rex expression in Splunk.
I am using the below which is not working for some reason.

<Search query> | rex <Field1> | rex "<tag1>?(P=Field1)</tag1><tag2>(?P<Field2>)" | table Field1,Field2

Is there any other way we can pass parameters to a rex expression?

0 Karma

maciep
Champion

I'm not sure exactly what you're asking either. I've used this below to use the value of a capture group later on in the rex, where "\1" is the value from the first capture group - in this case the malware_domain field. And I have to believe there is a way to escape field values as well is needed (would need to read up on rex), but maybe not.

rex "CEF.+rewrite (?<malware_domain>\S+).+(\1|nsdname)\.(?<apt_policy>[^\"]+)"
0 Karma

woodcock
Esteemed Legend

I am not exactly sure what you mean but perhaps you can make use of a macro to paramaterize your use of rex:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Usesearchmacros

0 Karma

Murali2888
Communicator

Thanks for your comments woodcock.

I tried creating a parameterised macro, but the macro is not handling the "Field Name" as a parameter.
Instead of populating the value of the field, the macro populates the Field Name itself.

0 Karma

woodcock
Esteemed Legend

The reason that I did not give a more clear answer was because your question was unclear. Do you mean that you mean that for this:

 <Search query> | rex field={FieldWithValue} "SomeRegEx"

You would like the rex performed on the field name that is represented by the value of the FieldWithValue field?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...