Splunk Search

How to create a regular expression on a multivalue field

jlkokko
Path Finder

I have a multivalue (MV) field "filetypes" with values such as:

test/Makefile.am,test/och_test.cc,test/fully1.py,24,FKP/pro.pl

I need to keep only the extension listed (such as am, cc, py, pl, etc..) so I have two questions:

A. The appropriate regular expression
B. Is it more appropriate to run a regex prior splitting a MV field or after?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this. It'll create a new field with just the extn.

your base search with file filetype
| rex field=filetypes max_match=0 "(?<extns>\.\w+)"

View solution in original post

jlkokko
Path Finder

Both of the above worked well...wondering if one less expensive than the other

0 Karma

woodcock
Esteemed Legend

Like this:

... | mvexpand filetypes | rex field=filetypes "^(?<file_prefix>.+)\.(?<file_suffix>[^\.]+)$"

woodcock
Esteemed Legend

Mine was geared towards enabling the later commands that you will surely be interested in doing. You can look at the Job Inspector to compare efficiencies.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this. It'll create a new field with just the extn.

your base search with file filetype
| rex field=filetypes max_match=0 "(?<extns>\.\w+)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...