Splunk Search

Rex Help with capturing query results as fields

irishmanjb
Path Finder

Hello Splunkers
I am running a query that is essentially returning two possible values in the raw table that I need to capture as fields:

11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified

I want to capture "Customer Accepted Terms" as one field and "Customer Qualified" so I can present those in a chart with some metrics

thanks in advance.

Tags (2)
1 Solution

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

View solution in original post

darrenfuller
Contributor

You can either do something like this, to capture each as its own field..and then use the presence of those fields as your counter:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test  | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<customer_accepted_terms>Customer\sAccepted\sTerms)"
| rex field=_raw "Special\sFinance\:\s(?<customer_qualified>Customer\sQualified)"
| eval customer_accepted_terms=if(isnull(customer_accepted_terms), 0, 1)
| eval customer_qualified=if(isnull(customer_qualified), 0, 1)

or you could capture the data after the "Special Finance" string and match it:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| rex field=_raw "Special\sFinance\:\s(?<special_finance_value>[\w\s]+)"
| eval acceptedterms=if(special_finance_value="Customer Accepted Terms", 1, 0)
| eval qualified=if(special_finance_value="Customer Qualified", 1, 0)

Hell, you could even do it in a single step for each like so:

| makeresults 
| eval test="11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms|11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified"
| makemv delim="|" test | mvexpand test | rename test AS _raw
| eval acceptedterms=if(match(_raw, "Special Finance: Customer Accepted Term"), 1, 0)
| eval qualified=if(match(_raw, "Special Finance: Customer Qualified"), 1, 0)

irishmanjb
Path Finder

this is great thanks for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...