Splunk Search

How to write regex for a multivalue field

gndivya
Explorer

I have a multivalue field which is got from a stats function. using mvfind function, how to write regex for this.

query...|stats list(result_id) by user

result_id is a multivalue field and it contains data like

r_id1
r_id2
r_id3
r_id4

I want to write a regex which matches as below
r_id2
r_id3

but the below eval doesnt work.

eval n=mvfind(result_id,"r_id2\nr_id3")
OR
eval n=mvfind(result_id,"r_id2\sr_id3")

please help.

Tags (1)
0 Karma

to4kawa
Ultra Champion

Verify the required result:

| makeresults count=2
| streamstats count
| eval _time=if(count=2,relative_time(_time,"-2d@d"),relative_time(_time,"-1d@d"))
| makecontinuous _time span=20m
| eval user="user_".(random() % 9 + 1)
| eval result_id="r_id".(random() % 4 + 1)
| streamstats count
| where count % 2 =1
| stats list(result_id) as result_id by user
| rex field=result_id max_match=10 "(?<result>\w+(2|3))"

Hi, folks

How to write regex for a multivalue field?

\w+(2|3) , this regex is.

recommend:

query...
|stats list(result_id) as result_id by user
| rex field=result_id max_match=10 "(?<result>\w+(2|3))"

How about this?

0 Karma

damann
Communicator

What is your suggested output?
Do you need your matching values as a new multivalue field? Or do you need the index of your matching values in your multivalue field?

Maybe this can help you:

| makeresults 
| eval mv="r_id1,r_id2,r_id3,r_id4"
|  makemv delim="," mv
| eval result=mvfilter(match(mv,"r_id2") OR match(mv,"r_id3"))
| eval n=if(isnotnull(mvfind(mv,"r_id2")),mvfind(mv,"r_id2"),""), n=if(isnotnull(mvfind(mv,"r_id3")),n.",".mvfind(mv,"r_id3"),"")
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @gndivya,
to help you in regex creating, could you share some example (eventually masked!)?
Ciao.
Giuseppe

0 Karma

gndivya
Explorer

| makeresults
| eval my_multival="4726,4722,4726"
| makemv tokenizer="([^,]+),?" my_multival

this is the sample one i m using... that result id will contain data like below
4726
4726
4722
4726
4726
4726
4722
4726

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...