topic Re: regex vs where match() in Splunk Search

regex vs where match()

yuanliu — Tue, 25 May 2021 22:07:25 GMT

I've never used |regex, but use |where match() quite often. Is the former just syntax sugar or is there any difference?

Re: regex vs where match()

aasabatini — Wed, 26 May 2021 06:04:16 GMT

Hi @yuanliu

did you mean rex command?

rex command give you the possibility to extract field in search time

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Rex

eval match it's just to put regex on condition

anyway the scope are different

Regards

Alessandro

Re: regex vs where match()

isoutamo — Wed, 26 May 2021 06:11:42 GMT

Basically both are doing the same thing. You should use job inspector to check which one perform better for your case.

Re: regex vs where match()

yuanliu — Wed, 26 May 2021 06:15:01 GMT

@aasabatini wrote:
did you mean rex command?

Not rex. regex.

Re: regex vs where match()

yuanliu — Thu, 27 May 2021 00:21:45 GMT

Is this confirmation that the implementation is different? The question is about language (as opposed to efficiency or suitability for a given use case), and I feel is an answerable one, unlike a question about, say, two seemingly equivalent regular expressions.