Adding rex to only part of search

[DamianS]

Hi all,

I have 2 different log file types, 1 of which I currently need to add fields in search time and the other already has them generated. I don't currently have permissions to change this.

In my head the search looks something like:

( log_type="log1" | rex field=_raw "PERL FOO to create FIELD1"  )
OR 
( log_type="log2" )

FIELD1 exists in both log1 and log2 but uses different regex to produce this, in log2 splunk already extracts it. But Splunk doesn't let me put parenthesis around these pipe things.

Any suggestions on how I just get the "rex" to apply to log1 but search on log1 and log2?

Thanks in advance.

[Ayn]

You can't split up the search pipeline like that, but what you could do if field1 isn't extracted at all for log1 is to extract your field using rex anyway. So just:

log_type="log1" OR log_type="log2" | rex "(?<field1>someregex)"

Just make sure the regex only matches the log1 events, so that it doesn't overwrite the correct extraction that's already done in log2.

[kristian_kolb]

please provide some (perhaps sanitized) log lines from both sources, and you'll most likely get help with the regex syntax.

/k

[DamianS]

Actually much quicker to get what I was looking for than I expected using this site to test my regex http://gskinner.com/RegExr/

Thanks again!

[DamianS]

Thanks, I'd tried this but I don't currently have the PERL refex skills to work this out, guess it's time to drastically improve these skills.