topic Re: Using a rex value in where statement in Splunk Search

Using a rex value in where statement

msarro — Fri, 09 Mar 2012 16:56:33 GMT

Hey everyone. In my data's filename there is an indicator which indicates the type of data that it is. It can either be "eu" or "cabs."
I am currently running into issues with this search:

index=cms| rex field=source "/home/cemp/CEMP/(?<EUORCABS>eu|cabs)/.*"|where EUORCABS=eu

It won't run. I have verified that the EUORCABS column is successfully created by running this search:

index=cms| rex field=source "/home/cemp/CEMP/(?<EUORCABS>eu|cabs)/.*"|table EUORCABS

All records have either a value of "eu" or "cabs" (without quotes). I have also tried casting it to a string, but no luck.

Am I missing something obvious here, or is splunk not searching properly?

Re: Using a rex value in where statement

Kate_Lawrence-G — Fri, 09 Mar 2012 17:07:20 GMT

Hmm..

have you tried a stats values(EUORCABS) AS and then tried the where on that field?

Re: Using a rex value in where statement

Lowell — Fri, 09 Mar 2012 17:26:07 GMT

I think the issue is with your "where" clause:

... | where EUORCABS=eu

This is evaluating the values of fields EUORCABS and eu. That's not what you want to do.

Either use

... | where EUORCABS="eu"

... | search EUORCABS=eu