https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197887#M57214 <P>OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:</P> <P>sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]</P> <P>The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.</P> Mon, 16 Jun 2014 14:16:04 GMT aweitzman 2014-06-16T14:16:04Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197882#M57209 <P>I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and for other sourcetype(PerfmonMk:Processor) i have to display the counters starting with % only. I use the following regex commands,</P> <PRE><CODE>Counters starting with # and % : | regex column="#[_A-Za-z]*|%[_A-Za-z]*" Counters starting with % : | regex column="%[_A-Za-z]*" </CODE></PRE> <P>Is there any way to do this?</P> Fri, 13 Jun 2014 10:34:35 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197882#M57209 vaishnavi07 2014-06-13T10:34:35Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197883#M57210 <P>Just construct the one regex to match all your cases. I can't see what the issue is with matching <CODE>[#%][_A-Za-z]*</CODE> (which is just a contraction of your first example regex). If hash is never present, what's the big deal? The regex will still match.</P> Fri, 13 Jun 2014 11:27:59 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197883#M57210 grijhwani 2014-06-13T11:27:59Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197884#M57211 <P>If i write single regex command and select sourcetype as "PerfmonMk:Processor" then the counters starting with # will get displayed. I don't need that. Only if i select the sourcetype "PerfmonMk:.Net CLR Exceptions" the counters that starts with # should get displayed.</P> Fri, 13 Jun 2014 12:22:08 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197884#M57211 vaishnavi07 2014-06-13T12:22:08Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197885#M57212 <OL> <LI><P>You could use the single regex as described, and then use a 'where' clause to eliminate the events you don't want.</P></LI> <LI><P>You could run two different searches with your two different regexes and use 'append' to turn them into a single result set.</P></LI> </OL> Fri, 13 Jun 2014 16:55:29 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197885#M57212 aweitzman 2014-06-13T16:55:29Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197886#M57213 <P>Hi Can you please give me an example?</P> Mon, 16 Jun 2014 08:40:18 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197886#M57213 vaishnavi07 2014-06-16T08:40:18Z https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197887#M57214 <P>OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:</P> <P>sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]</P> <P>The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.</P> Mon, 16 Jun 2014 14:16:04 GMT https://community.splunk.com/t5/Splunk-Search/Execute-regex-based-on-condition/m-p/197887#M57214 aweitzman 2014-06-16T14:16:04Z