Splunk Search

Using OR with rex commands or combining search results

RVDowning
Contributor

I need to perform a search that extracts user ids from unformatted log lines where the user id would be extracted by one of the following rex commands.

Conceptually it would be something like:

sourcetype="LogsPRD" 22CD91CF-C32F-43E0-A8A6-A09F00D0B9F4  
| rex field=_raw "Users\\\(?<xxx>\w*)" 
OR rex field=_raw ": FEDERATED\\\(?<xxx>\w*)" 
OR rex field=_raw "user FEDERATED\\\(?<xxx>\w*)" 
| eval xxx=upper(xxx) | stats values(xxx)

So, it is essentially three searches with the results to be combined. Does this make any sense?

tfletcher_splun
Splunk Employee
Splunk Employee

The best thing to do would probably be to use props and transforms. If you define each of these rex commands as a REPORT transform you can then specify multiple in your props.conf and the first successful extraction will be used. See that here:

[http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Createandmaintainsearch-timefieldextract...]

In the shortterm you can make the regex more complicated to use it in one.

1

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

argh link isn't taking you to the section of the page, just scroll there, it's the first example, Configuring a field extraction that utilizes multiple field transforms

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...