topic Re: How do I match a regex query in a CSV? in Splunk Search

How do I match a regex query in a CSV?

JohnGilmour — Wed, 12 Dec 2018 14:36:32 GMT

Hello,

I have a CSV file full of regex queries. What I am looking at doing is matching those with a regex in the CSV.

Ideas?

Re: How do I match a regex query in a CSV?

dmarling — Wed, 12 Dec 2018 15:03:13 GMT

Can you provide a bit more information such as an example of the data in the csv and how you are attempting to use it in a dashboard/query?

Re: How do I match a regex query in a CSV?

JohnGilmour — Wed, 12 Dec 2018 15:15:13 GMT

Hello - I'm looking at a dashboard for Spam, with the email SUBJECT (Field) matching a regex in a file.

AKA if the subject matches one of the regex rules in the file.

E.G
e-?ma[il1]+ .{0,10}suspen
e-?ma[il1]{1,} user
from.helpdesk
fu[il1]{2,}.*ma[il1]+[ -]?box

Thanks,

Re: How do I match a regex query in a CSV?

richgalloway — Wed, 12 Dec 2018 18:53:38 GMT

The performance will be awful, but you could probably do it with map.

| inputlookup regex.csv | map search="index=foo SUBJECT=* | where match(SUBJECT, "$regex$")"

Re: How do I match a regex query in a CSV?

dmarling — Wed, 12 Dec 2018 19:13:25 GMT

This should provide better performance depending on the size of the lookup file:

| where
    [| inputlookup regexlookup.csv
    | eval matcher="match(subject,\"".regex."\")"
    | stats values(matcher) as search
    | eval search=mvjoin(search. " OR ")]

You can append that to any search and it will add a where statement that is populated by a serious of matches from the regex in your lookup file. If it's a massive lookup file this may cause some issues, but if it's not too big it should work alright. You'll need to substitute the name of the lookup file where I have regexlookup.csv and the name of the field you want to match on where I have subject.

Edit: I forgot to mention that you'll also need to make sure to update the regex field in the match statement to match the field name of your regex in the lookup file too.

Re: How do I match a regex query in a CSV?

dmarling — Fri, 05 Apr 2019 20:24:20 GMT

@JohnGilmour if this answer or the other one assisted you, please make sure to accept either of them as the accepted answer. Thank you!

Re: How do I match a regex query in a CSV?

woodcock — Sun, 07 Apr 2019 13:59:51 GMT

I believe that you are looking for this, right?

https://answers.splunk.com/answers/386488/regex-in-lookuptable.html