Splunk Search
Highlighted

Execute regex based on condition

Explorer

I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and for other sourcetype(PerfmonMk:Processor) i have to display the counters starting with % only. I use the following regex commands,

Counters starting with # and % : |  regex column="#[_A-Za-z]*|%[_A-Za-z]*"
Counters starting with % : |  regex column="%[_A-Za-z]*"

Is there any way to do this?

Tags (1)
Highlighted

Re: Execute regex based on condition

Motivator

Just construct the one regex to match all your cases. I can't see what the issue is with matching [#%][_A-Za-z]* (which is just a contraction of your first example regex). If hash is never present, what's the big deal? The regex will still match.

0 Karma
Highlighted

Re: Execute regex based on condition

Explorer

If i write single regex command and select sourcetype as "PerfmonMk:Processor" then the counters starting with # will get displayed. I don't need that. Only if i select the sourcetype "PerfmonMk:.Net CLR Exceptions" the counters that starts with # should get displayed.

0 Karma
Highlighted

Re: Execute regex based on condition

Motivator
  1. You could use the single regex as described, and then use a 'where' clause to eliminate the events you don't want.

  2. You could run two different searches with your two different regexes and use 'append' to turn them into a single result set.

0 Karma
Highlighted

Re: Execute regex based on condition

Explorer

Hi Can you please give me an example?

0 Karma
Highlighted

Re: Execute regex based on condition

Motivator

OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:

sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]

The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.