Splunk Search

Can I use regex within an IF statement?

albinortiz
Engager

This is what I have so far:

| eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty"

What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible).

Tags (2)
0 Karma
1 Solution

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

View solution in original post

somesoni2
Revered Legend

No you can't, but you can do something like this

... | rex field=_raw "your reg ex 1 to extract <field1>" | rex field=_raw "your reg ex 2 to extract <field2>" 
| eval output=if(Object="false", field1, field2) 
0 Karma

albinortiz
Engager

Thanks both yours and the answer below worked. Thanks for all the help. I've tried this one before but never thought I had to call the rex field command again.

0 Karma

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

albinortiz
Engager

Thanks both yours and the answer above worked. Thanks for all the help.

0 Karma

auraria1
Path Finder

No problem, glad I could help.

Evals can be a bit tricky, always a fun time working through those switches.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...