rex command overview
Use to either extract fields using regular expression named groups, or replace or substitute characters in a field using sed expressions.
rex command matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names.
mode=sed, the given sed expression used to replace or substitute characters is applied to the value of the chosen field. This sed-syntax is also used to mask sensitive data at index-time.
If a field is not specified, the regular expression or sed expression is applied to the
_raw field. Running the
rex command against the
_raw field might have a performance impact.
rex command for search-time field extraction or string replacement and character substitution.
The required syntax is in bold.
- [field=<field>] [max_match=<int>] [offset_field=<string>]
- ( <regex-expression> | mode=sed <sed-expression> )
reverse command examples
rex command syntax details
This documentation applies to the following versions of Splunk® Cloud Services: current