https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479859#M134486 <P>I want to match a reg ex pattern (e.g. "aaa\s+:\d\d") from a lookup file.</P> <PRE><CODE>pattern,output_value "aaa\s+:\d\d:", 2 "aaa\s+:\d:", 1 </CODE></PRE> <P>So, whenever first pattern matches in the event, I should get value as 2. <BR /> How can we do this?</P> Wed, 11 Sep 2019 17:15:49 GMT ankitarath2011 2019-09-11T17:15:49Z https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479859#M134486 <P>I want to match a reg ex pattern (e.g. "aaa\s+:\d\d") from a lookup file.</P> <PRE><CODE>pattern,output_value "aaa\s+:\d\d:", 2 "aaa\s+:\d:", 1 </CODE></PRE> <P>So, whenever first pattern matches in the event, I should get value as 2. <BR /> How can we do this?</P> Wed, 11 Sep 2019 17:15:49 GMT https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479859#M134486 ankitarath2011 2019-09-11T17:15:49Z https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479860#M134487 <P>Build a subsearch to build the EVALs for you?</P> <PRE><CODE>| makeresults | eval _raw="aaa :4:" | eval [| inputlookup test_regex.csv | fields pattern output_value | eval search="test=if(match(_raw,\"".pattern."\"),\"".output_value."\", test), " | fields search | mvcombine search | eval search=trim(trim(mvjoin(search," "),"| eval"),", ")] </CODE></PRE> Sun, 15 Sep 2019 12:26:07 GMT https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479860#M134487 mhoogcarspel_sp 2019-09-15T12:26:07Z https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479861#M134488 <P>Hey getting below error</P> <P>Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.</P> Mon, 16 Sep 2019 07:45:31 GMT https://community.splunk.com/t5/Splunk-Search/regex-in-lookup-file/m-p/479861#M134488 ankitarath2011 2019-09-16T07:45:31Z