Splunk Search

Can I use regex within an IF statement?

albinortiz
Engager

This is what I have so far:

| eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty"

What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible).

Tags (2)
0 Karma
1 Solution

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

View solution in original post

somesoni2
Revered Legend

No you can't, but you can do something like this

... | rex field=_raw "your reg ex 1 to extract <field1>" | rex field=_raw "your reg ex 2 to extract <field2>" 
| eval output=if(Object="false", field1, field2) 
0 Karma

albinortiz
Engager

Thanks both yours and the answer below worked. Thanks for all the help. I've tried this one before but never thought I had to call the rex field command again.

0 Karma

auraria1
Path Finder

The way I do it is with match.

| eval output = if(match(Object,"regex goes here"),"false", "empty")

Or something along those lines.

Does that make sense or help?

albinortiz
Engager

Thanks both yours and the answer above worked. Thanks for all the help.

0 Karma

auraria1
Path Finder

No problem, glad I could help.

Evals can be a bit tricky, always a fun time working through those switches.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...