topic Re: Group by multiselect regex number range in Splunk Search

Group by multiselect regex number range

l0gik — Wed, 22 Apr 2020 15:18:30 GMT

I have a multiselect option in my dashboard that defines regex number ranges. I want to then group the "selected" number range elements and compare those against the ones that weren't selected. To begin my number range elements look like this:
(852[01])
(4[0-4][0-9]{2}|45[0-7][0-9]|458[01])
(850[0-9]|851[0-3])
(831[4-9]|83[2-9][0-9]|84[0-5][0-9]|846[0-7])

Note, these are regex ranges.

My search contains the field value to compare the regex against,
Message{}.itemnumber = itemNumber is the field value to check against regex number ranges
I tried
| eval SELECTED=case(itemNumber=$ITEM_NUMBER$, Selected, 1=1, Unselected)
Any suggestions on how to accomplish this?

Re: Group by multiselect regex number range

richgalloway — Wed, 22 Apr 2020 17:19:10 GMT

The = operator is a literal character-for-character comparison, which won't work for regex strings. Use the match function, instead.

| eval SELECTED=case(match(itemNumber, $ITEM_NUMBER|s$), Selected, 1=1, Unselected)

Re: Group by multiselect regex number range

l0gik — Wed, 22 Apr 2020 17:52:23 GMT

What is the |s in the $ITEM_NUMBER$ token?

Re: Group by multiselect regex number range

richgalloway — Wed, 22 Apr 2020 19:55:00 GMT

It puts the value inside quotation marks.