rex command overview
Use the SPL2 rex command to either extract fields using regular expression named groups, or replace or substitute characters in a field using sed expressions.
The rex command matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names.
When mode=sed, the given sed expression used to replace or substitute characters is applied to the value of the chosen field. This sed-syntax is also used to mask sensitive data at index-time.
If a field is not specified, the regular expression or sed expression is applied to the _raw field. Running the rex command against the _raw field might have a performance impact.
Use the rex command for search-time field extraction or string replacement and character substitution.
Syntax
The required syntax is in bold.
- rex
- [field=<field>] [max_match=<int>] [offset_field=<string>]
- ( <regex-expression> | mode=sed <sed-expression> )
See also
| reverse command examples | rex command syntax details |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!