Splunk Enterprise

Need a regex toprint a special value if my matching would be commands

bapun18
Communicator

I am working on a dashboard where my source have values like /opt/commands/abc.env, I want to print XYZ in ConfigType if my source contains commands.

Right now I am using regex | rex field=source "(?<ConfigType>commands)" and it's printing ConfigType=commands but I need to print ConfigType=XYZ

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval ConfigType=if(match(source,"commands"),"XYZ",null())

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval ConfigType=if(match(source,"commands"),"XYZ",null())
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>