topic Re: extract field value/variable into regex in Splunk Search

extract field value/variable into regex

yuming1127 — Wed, 28 Apr 2021 03:35:17 GMT

my search...... product_name="orange_wallet"
| fields product_name,productID
| rex field=tag_description "(?i)orange_wallet(?<description>\w+)(?<size>\w+)"
| table product_name,productID,description,size

My question is can we include a field values into the regex? Aim is to replace orange_wallet with <product_name> and it need to be case insensitive.

Thanks.

Re: extract field value/variable into regex

manjunathmeti — Wed, 28 Apr 2021 09:28:40 GMT

hi @yuming1127,

No, you cannot use field values in the regex. Instead of that, you can extract the product name into a separate field and compare it with the actual one.

my search...... product_name="orange_wallet" | fields product_name,productID,tag_description | rex field=tag_description "(?i)(?<product_name_rex>\w+)(?<description>\w+)(?<size>\w+)" | where lower(product_name)=lower(product_name_rex) | table product_name,productID,description,size

If this reply helps you, a like would be appreciated.

Re: extract field value/variable into regex

ITWhisperer — Wed, 28 Apr 2021 08:45:46 GMT

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on.

Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want.