Splunk Search

Rex for a field with varying number of values

BinnyK
Explorer

I have some values in a fied which are email addresses.

eg: Values of F may be
"[""email_type2@gmail.com""]"
"[""email_type1@gmail.com"",""email_type2@hotmail.com""]"
"[""email_type1@live.com"",""email_type2@aol.com"",""email_type3@outlook.com""]"

The field F may have 1, 2 or 3 values. If there is only 1 value, it is going to be email_type2, if there are 2 values it will be email_type1 followed by email_type2 and if there are going to be 3 values, it is going to be email_type1 followed by email_type2 and email_type3.

I need to extract 3 fields, type1, type2 and type3 and include those values in the extracted fields. Can someone help me with this?

Tags (2)
0 Karma

BinnyK
Explorer

I created some complex regex, but solved it.

rex field=F "[\"(?.)\",\"(?.)\",\"(?.*)\"]" | rex field=F "[\"(?[^,]+)\",[^,]+]" | rex field=F "[\"[^,]+\",\"(?[^,]+)\"]" | rex field=F "[\"(?[^,]+)\"]"

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search | eval email_type1=mvindex(split(F,","),0) | eval email_type2=mvindex(split(F,","),1) | eval email_type3=mvindex(split(F,","),2)

The value of fields email_type2 and email_type3 will be null for events where they are not available. There may be more value cleanup required, so run the above query and paste the results (if you need cleanup).

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Is the max number of emails that field F can have is fixed (e.g. 3 as per example)??

0 Karma

BinnyK
Explorer

It can be from 1 to 3.
I can easily use rex to extract fields if it was a fixed number of elements inside. I cant work out a good regex for varying number of elements in each log's F field

0 Karma

sundareshr
Legend

Try this

... | rex field=F max_match=0 "\"\"(?<em>[^@]+@[^\"]+)\"" | mvexpand em | ...
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...