Splunk Search

Rex help need to capture two values returned by query as fields

irishmanjb
Path Finder

Hello Splunkers
I have a query that returns two possible values

11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified

What I want to do is capture "Customer Accepted" and "Customer Qualified" as two separate fields so I can present them with some metrics.

Ultimately I want to have a report like this

Host Customer Qualified Customer Accepted adoption rate
Location 1 10 5 50%

thanks in advance

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

index=<your_index>|  rex "(?<field1>Customer Accepted)"|  rex "(?<field2>Customer Qualified)"

View solution in original post

0 Karma

irishmanjb
Path Finder

great info thanks

0 Karma

mayurr98
Super Champion

try this:

index=<your_index>|  rex "(?<field1>Customer Accepted)"|  rex "(?<field2>Customer Qualified)"
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...