Splunk Search

Can I use regex within an IF statement?

albinortiz
Engager

This is what I have so far:

| eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty"

What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible).

Tags (2)
0 Karma
1 Solution

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

View solution in original post

somesoni2
Revered Legend

No you can't, but you can do something like this

... | rex field=_raw "your reg ex 1 to extract <field1>" | rex field=_raw "your reg ex 2 to extract <field2>" 
| eval output=if(Object="false", field1, field2) 
0 Karma

albinortiz
Engager

Thanks both yours and the answer below worked. Thanks for all the help. I've tried this one before but never thought I had to call the rex field command again.

0 Karma

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

albinortiz
Engager

Thanks both yours and the answer above worked. Thanks for all the help.

0 Karma

auraria1
Path Finder

No problem, glad I could help.

Evals can be a bit tricky, always a fun time working through those switches.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...