topic Re: Using LOOKUP to insert a Regex string - is it possible? in Splunk Search

Using LOOKUP to insert a Regex string - is it possible?

ipicbc — Mon, 10 Apr 2017 10:28:41 GMT

I want to insert a different regex string into my query for each host. I am thinking that a way to achieve this is by making a lookup into a CSV to retrieve the regex string, allocating to a new field, and then inserting it further on in the query.

Is this possible or ridiculous?

Thanks for your advice

Re: Using LOOKUP to insert a Regex string - is it possible?

martin_mueller — Mon, 10 Apr 2017 13:34:59 GMT

That's entirely possible. Say your lookup looks like this:

host,expression
A,foo
B,bar

Add your lookup to your data as automatic, and search like this:

base search | where match(some_field, expression)

That would filter to only keep events where the host-based expression matches some_field.

Re: Using LOOKUP to insert a Regex string - is it possible?

ipicbc — Mon, 10 Apr 2017 16:28:57 GMT

Thanks. How would I get the regex statement into expression?

Re: Using LOOKUP to insert a Regex string - is it possible?

martin_mueller — Mon, 10 Apr 2017 19:18:49 GMT

expression is the field produced by the automatic lookup.