Splunk Search

Execute regex based on condition

vaishnavi07
Explorer

I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and for other sourcetype(PerfmonMk:Processor) i have to display the counters starting with % only. I use the following regex commands,

Counters starting with # and % : |  regex column="#[_A-Za-z]*|%[_A-Za-z]*"
Counters starting with % : |  regex column="%[_A-Za-z]*"

Is there any way to do this?

Tags (1)

grijhwani
Motivator

Just construct the one regex to match all your cases. I can't see what the issue is with matching [#%][_A-Za-z]* (which is just a contraction of your first example regex). If hash is never present, what's the big deal? The regex will still match.

0 Karma

aweitzman
Motivator

OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:

sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]

The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.

0 Karma

vaishnavi07
Explorer

Hi Can you please give me an example?

0 Karma

aweitzman
Motivator
  1. You could use the single regex as described, and then use a 'where' clause to eliminate the events you don't want.

  2. You could run two different searches with your two different regexes and use 'append' to turn them into a single result set.

0 Karma

vaishnavi07
Explorer

If i write single regex command and select sourcetype as "PerfmonMk:Processor" then the counters starting with # will get displayed. I don't need that. Only if i select the sourcetype "PerfmonMk:.Net CLR Exceptions" the counters that starts with # should get displayed.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...