erex
Contents
erex
Synopsis
Automatically extracts field values similar to the example values.
Syntax
erex [<field>] examples=<erex-examples> [counterexamples=<erex-examples>] [fromfield=<field>] [maxtrainers=<int>]
Required arguments
- examples
- Syntax: <erex-examples>
- Description: A comma-separated list of example values for the information to be extracted and saved into a new field.
Optional arguments
- counterexamples
- Syntax: counterexamples=<erex-examples>
- Description: A comma-separated list of example values that represent information not to be extracted.
- field
- Syntax: <string>
- Description: A name for a new field that will take the values extracted from fromfield. If field is not specified, values are not extracted, but the resulting regular expression is generated and returned in an error message. That expression can then be used with the rex command for more efficient extraction.
- fromfield
- Syntax: fromfield=<field>
- Description: The name of the existing field to extract the information from and save into a new field. Defaults to _raw.
- maxtrainers
- Syntax: maxtrainers=<int>
- Description: The maximum number values to learn from. Must be between 1 and 1000. Defaults to 100.
Erex examples
- <erex-examples>
- Syntax: ""<string>(, <string> )*""
- Description: A comma-separated list of example values.
Description
Example-based regular expression extraction. Automatically extracts field values from fromfield (defaults to _raw) that are similar to the examples (comma-separated list of example values) and puts them in field. If field is not specified, values are not extracted, but the resulting regular expression is generated and returned in an error message. That expression can then be used with the rex command for more efficient extraction. To learn the extraction rule for pulling out example values, it learns from at most maxtrainers (defaults to 100, must be between 1-1000).
Examples
Example 1: Extracts out values like "7/01" and "7/02", but not patterns like "99/2", putting extractions into the "monthday" attribute.
... | erex monthday examples="7/01, 07/02" counterexamples="99/2"Example 2: Extracts out values like "7/01", putting them into the "monthday" attribute.
... | erex monthday examples="7/01"See also
extract, kvform, multikv, regex, rex, xmlkv
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the erex command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 View the Article History for its revisions.