Splunk Search

Can I use regex within an IF statement?

albinortiz
Engager

This is what I have so far:

| eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty"

What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible).

Tags (2)
0 Karma
1 Solution

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

View solution in original post

somesoni2
Revered Legend

No you can't, but you can do something like this

... | rex field=_raw "your reg ex 1 to extract <field1>" | rex field=_raw "your reg ex 2 to extract <field2>" 
| eval output=if(Object="false", field1, field2) 
0 Karma

albinortiz
Engager

Thanks both yours and the answer below worked. Thanks for all the help. I've tried this one before but never thought I had to call the rex field command again.

0 Karma

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

albinortiz
Engager

Thanks both yours and the answer above worked. Thanks for all the help.

0 Karma

auraria1
Path Finder

No problem, glad I could help.

Evals can be a bit tricky, always a fun time working through those switches.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...