Splunk Dev

How do I filter events and extract fields in a single regular expression command

chrisxue815
Engager

Q1:
How do I merge these two regular expressions? (which are identical but one for filtering events, the other for extracting fields)

I am | regex _raw = "I am (?<Name>.*)" | rex "I am (?<Name>.*)" | stats count Count by Name

Q2:
I already tried

I am | setfields Name = 0 | rex "I am (?<Name>.*)" | where Name != 0 | stats count Count by Name

Somehow it didn't work, until I changed where Name != 0 to where not Name = 0.

From what I learnt in other answers, the behavior of Name != 0 and not Name = 0 would differ when Name doesn't exist, but in this case Name should always exist after setfields Name = 0.

Did I miss something?

Tags (1)
0 Karma

snoobzilla
Builder

Bottom line is you don't do both in same regex. It looks like you are trying to only count by Name when there is a value for Name. Try this...

I am | regex _raw = "I am (?<Name>.*)" | stats count AS Count by Name

Stats will only count the when there is a value for Name.

Should get same results with this where the search Name=* requires Name.

I am | regex _raw = "I am (?<Name>.*)" | search Name=* | stats count AS Count by Name
0 Karma

michael_kushma
Path Finder

What are you trying to do?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...