Below is the current search I have put together to extract a couple fields. The extraction of the ClientID
from the source
works perfect. I now need to extract the filetype
from the import_File
field based on the previously extracted ClientID
.
Search:
source=*D:\\XSP\\importhelpers* source=*IH_Daily\\DebugImportHelper* Moved earliest=-36h@h
| rex field=source "importhelpers\\\\+(?ClientID[^\\\\]+)"
| rex field=import_File ""ClientID"\\\\\\\\\\+(?filetype[^\\]+)"
import_File Examples:
D:\XSP\Builds\IRM\InternalImports\IRM\Account\IRM_Accounts_20170810_csv.xml
D:\XSP\Builds\USBI\InternalImports\IRM\Manager\IRM_Accounts_20170810_csv.xml
import_File
where file_Type
will be Account
or Manager
.IRM
and USBI
right before that is the ClientID
that is extracted from the first rex field. This ClientID
will be different for each client and I will need to extract the filetype
based on this.If I understand you correctly, you would like to use the values
of the previously generated-by-rex-at-search-time field ClientID
inside of a later rex
call as part of the RegEx string/pattern, right?
If the field import_File contains both ClientID and filetype, why not just extract ClientID along with filetype from import_File field only. This way you can avoid reference previously extracted value (dynamic) in your 2nd rex.
source=*D:\\XSP\\importhelpers* source=*IH_Daily\\DebugImportHelper* Moved earliest=-36h@h
| rex field=import_File "InternalImports\\\\(?<ClinetID>[^\\\]+)\\\\(?<filetype>[^\\\]+)"
Assuming that IRM and USBI are clientID's. Account and Manager are filetype's
| makeresults | eval import_File="D:\XSP\Builds\IRM\InternalImports\IRM\Account\IRM_Accounts_20170810_csv.xml;D:\XSP\Builds\USBI\InternalImports\IRM\Manager\IRM_Accounts_20170810_csv.xml " | makemv delim=";" import_File| mvexpand import_File| eval test=replace(import_File,"\\","#") | rex field=test "\S+:#\w+#\w+#(?P<ClientID1>\w+)#\w+#\w+#(?P<filetype>\w+)#(?P\S+)" | eval filetype=if(clientID==clientID1, filetype, "NA")
I reformatted your OP but some of the text in the rex
commands was lost when you submitted it because it was not called out as code. Please fix.
You can stack extractions. It is easier to see in a transforms conf stanza. See in this example of extracting header then pulling from the header field as the source key.
http://www.georgestarcher.com/splunk-bringing-in-data-minecraft-the-model-method/