topic Re: How to write an eval if field value matches a regex good otherwise bad? in Splunk Search

How to write an eval if field value matches a regex good otherwise bad?

Log_wrangler — Sun, 15 Apr 2018 02:17:59 GMT

Need a little help writing an eval that uses a regex to check if the field value is a number 5 digits long and the 1st digit is not 0.

some pseudo code:

...| eval <field>  = if (regex =match, good, bad)

Thank you

Re: How to write an eval if field value matches a regex good otherwise bad?

somesoni2 — Sun, 15 Apr 2018 03:19:54 GMT

Try like this

...| eval YourFieldName=if(match(fieldToMatch,"^(\d{5})$") AND NOT match(fieldToMatch,"^0\d{4}"),"good", "bad")

Re: How to write an eval if field value matches a regex good otherwise bad?

niketn — Tue, 29 Sep 2020 19:06:00 GMT

@Log_wrangler, the regular Expression that you need is ^((?!0)(\d{1,5}))$. It will not match if the Account_ID start with 0 or if the length of Account_ID is > 5 or any non-numeric character is present in the Account_ID.

Following is a run anywhere example with some sample data to test:

| makeresults 
| eval Account_ID="87347,123,1,0,848/'A$,993884,000,0123,949A4,48A4" 
| makemv Account_ID delim="," 
| mvexpand Account_ID 
| eval validation_result= if(match(Account_ID,"^((?!0)(\d{1,5}))$"),"good","bad")

If you want to understand how this Regular Expression works try out on regex101(link attached): https://regex101.com/r/f0QOAB/1

Re: How to write an eval if field value matches a regex good otherwise bad?

Log_wrangler — Mon, 16 Apr 2018 22:02:18 GMT

thank you for the reply, I like the way you wrote this in parts, fyi I changed this "^(\d{1,5})$") and this "^0\d{1,4}" but I still need to eval any account_id starting with 0 as bad including if its only one digit.

Thank you