Splunk Search

how to merge multiple rex commands

abhayneilam
Contributor

Hi,

I have a query as follows :

index="maa" |rex field="Location" (?(?i)"delhi") | eval ONE=lower(ONE) |stats count(ONE) by ONE | append [search index="maa" |rex field="Location" | (?(?i)"kol") | eval ONE=lower(ONE) |stats count(ONE) by ONE ] | append [ search index="maa" | rex field="Location" (?(?i)"mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE]

Here, I am using 3 keywords "delhi","kol" and "mumbai" but I have used 3 rex for this..can I merge three into one rex. when I am merging as follows I am getting the correct count for the keywords. Please help

index "maa" | rex field="Locaion" (?(?i)"delhi|kol|mumbai") | eval ONE=lower(ONE) |stats count(ONE) by ONE

0 Karma

rakesh_498115
Motivator

Hi Abhay..

You can create field aliases for your thress rex fields as location and then you can use the stats count by location like this .

rex field="Location" (?(?i)"delhi")
rex field="Location" | (?(?i)"kol")
rex field="Location" (?(?i)"mumbai")

Now go to Field Aliases and create a common alias for these three fields i.e say location .

Then use your query like this..

index="maa" | stats count by location

Would you give the desired results..

0 Karma

MuS
SplunkTrust
SplunkTrust

the problem is, that in the data multiple city occur at the same line:

abhay|26|koldelhigmumbaiis_delhiood_di
murari|30|ranigang
abc|32|mumbai is delhi place
murari|30|ranigang_kolbabbu is kol
murari|30|delHI is not in kolkata
mno|100|delhi
murari|30|ranig
xyz|100|delhi

abhayneilam want to match only ONE city per line, either delhi, kol or mumbai.
I cannot create any regex matching this pattern on gskinner....sorry but on the other hand I'm no regex expert after all 🙂

0 Karma

bmacias84
Champion

Why not combine them into one rex statement with multiple ability to match multiple times.


rex field="Location"(?(?im)"(delhi|mumbai|kol)")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...