erex
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
erex
Synopsis
Automatically extracts field values similar to the example values.
Syntax
erex [field] examples=erex-examples [counterexamples=erex-examples] [fromfield=field] [maxtrainers=int]
Arguments
- examples
- Datatype: <erex-examples>
- Description:
- counterexamples
- Datatype: <erex-examples>
- Description:
- fromfield
- Datatype: <field>
- Description:
- maxtrainers
- Datatype: <int>
- Description:
Description
Example-based regular expression extraction. Automatically extracts field values from fromfield (defaults to _raw) that are similar to the examples (comma-separated list of example values) and puts them in field. If field is not specified, values are not extracted, but the resulting regular expression is generated and returned in an error message. That expression can then be used with the rex command for more efficient extraction. To learn the extraction rule for pulling out example values, it learns from at most maxtrainers (defaults to 100, must be between 1-1000).
Examples
Example 1: Extracts out values like "7/01" and "7/02", but not patterns like "99/2", putting extractions into the "monthday" attribute.
... | erex monthday examples="7/01, 07/02" counterexamples="99/2"Example 2: Extracts out values like "7/01", putting them into the "monthday" attribute.
... | erex monthday examples="7/01"
See also
extract, kvform, multikv, regex, rex, xmlkv
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.