Filter rex value in where clause

[Munatdev]

Hi,

I want to filter the below rex value in where clause but its not working.

| rex field=_raw ":[ ]*(?<error>[^:]+$)"
| where error="No route to host (Host unreachable)"

Kindly suggest.

Thanks in advance!

[isoutamo]

Hi
3rd example on usage should work. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Where
You can also use like and/or match functions.
r. Ismo

[Munatdev]

Hi Champion,

Thanks for the information!

Can you please share the exact query which should work, I tried with both like and match but its not working.

Thanks!