Hey!
So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this?
PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow.
Thanks in advance!!
I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""
It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"
I think you're looking for this:
rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g""
It works for me in this run anywhere Splunk command:
| stats count | eval testfield="user1 user2 user3 user4 user5 user6" | rex field=testfield mode=sed "s/(\w+)/account=\"&\"/g"
Yes!! That's it! Thank you!
I had to change a little bit to work though:
"| rex field=FormatSS mode=sed "s/(\w+)/user_id=\"&\" OR/" max_match=0 | nomv FormatSS | rex field=FormatSS mode=sed "s/^/(/ s/OR$/)/" max_match=0"
I was extracting values from mv fields.
Great. Glad I could help!
Hi
These values are static or dynamic?
If static or near, you can put them on a lookip and then use it to filter you search, e.g.
Your_sear h [ | inputlookup my_lookip.csv | fields account ] | table account
In dynamic use a subsearch instead lookup
Your_search [ search secondary_search | dedup 0 account | fields account ] | table account
Bye.
Giuseppe
Dynamic, the user puts the users values in a Text Input this way "user1 user2 user3 user4 user5 user6 (.....)" and then I work with it in the dashboard. But thanks anyway!