Splunk Search

Could you please help me with using REX/REGEX inside eval?

Loves-to-Learn Lots


Could you please help me with using REX/REGEX inside eval? Here is what I'm trying to do 

| makeresults
| eval User="user1=test@domain.com | use1=test1"
| makemv delim="|" User | mvexpand User
| fields - _time
| eval signature="87347,123,1,0,84"
| makemv signature delim=","
| mvexpand signature
| eval account=if(like(signature,"87347") AND like(User,"%@%" )," REGEX USER TO KEEP EVERYTHING BEFORE @ "," DONT MAKE ANY CHANGES , KEEP THE USER WITH @")




Labels (4)
0 Karma


Given that the only time you change user is if signature is 87347 and in that instance you want everything before the @, just use split

| eval account=if(like(signature,"87347"),mvindex(split(user,"@"),0),user)
0 Karma


An alternative is to use replace

| eval account=if(like(signature,"87347"),replace(user,"@.*",""),user)

Like ITWhisperer said, you do not need to test for %@%  if your final operation is to get rid of @%.  In the code you illustrated, the test for signature also do not include wildcard.  Therefore, like(signature, "87347") is semantically identical to signature=="87347", but slightly more expensive.  Thanks for bring my attention to function "like()", BTW.  I only used match() before.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...