topic Re: How do I "OR" two regexs for two different fields? in Splunk Search

How do I "OR" two regexs for two different fields?

nick405060 — Thu, 30 Aug 2018 18:55:44 GMT

I need to be able to do:

... | regex fieldA="<regex>" OR regex fieldB="<regex>" | ...

All of the other rex answers are suggesting a pipe, which wouldn't work here as far as I know.

Re: How do I "OR" two regexs for two different fields?

skoelpin — Thu, 30 Aug 2018 19:17:24 GMT

Why use an OR? Why not just create two different fields? You're trying to capture different values right?

Re: How do I "OR" two regexs for two different fields?

nick405060 — Thu, 30 Aug 2018 19:44:39 GMT

I already have the two fields. I need to alert if one or both of them matches their respective regex.

Re: How do I "OR" two regexs for two different fields?

sudosplunk — Thu, 30 Aug 2018 20:06:11 GMT

I think you can achieve this with eval rather than rex. Can you paste some redacted events.

Re: How do I "OR" two regexs for two different fields?

nick405060 — Thu, 30 Aug 2018 20:10:44 GMT

regex sender="(?i)abc\d+@gmail.com" OR
message_subject="aBC|baC"

Re: How do I "OR" two regexs for two different fields?

nick405060 — Thu, 30 Aug 2018 20:18:51 GMT

It's definitely possible using eval and then a single regex search, but if anyone else has a less messy and more elegant way of doing this, it would be much appreciated (and I'm sure other people will/have wanted to do the same thing)

Re: How do I "OR" two regexs for two different fields?

sudosplunk — Thu, 30 Aug 2018 21:34:00 GMT

Give this a shot (not tested; might work):

... | eval x=if(match(sender, "(?i)abc\d+@gmail.com"), 1, null)
    | eval y=if(match(message_subject, "aBC|baC"), 1, null)
    | stats  count by x, y 
    | where count > 1

Re: How do I "OR" two regexs for two different fields?

nick405060 — Thu, 30 Aug 2018 22:15:27 GMT

Thanks a bunch!! An admin should convert your comment to an answer. Much more elgant than what I did. I concat’d the two fields with a “#” in between and then regex’d on that new single field; the regex OR’d the before # and after #. Your solution is neater.

Re: How do I "OR" two regexs for two different fields?

mstjohn_splunk — Thu, 30 Aug 2018 22:18:59 GMT

Hi @nick405060, you asked and therefore, you received. I converted @nittala_surya 's comment to an answer. Would you mind approving it for me? Why not throw that user an upvote while you're at it 😉

Thanks for posting!