http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element
According to this, there is a regex comparator usable with Filter.
I can't find any example, how should I use it.
What I've tried:
| pivot [...] Filter fieldname regex ".*"
But I get the following error:
Error in 'PivotProcessor': Error in 'PivotUtil': Cannot filter using 'regex' on field type 'string'
How can I apply a regex-filter to my pivot?
I would log a support request for this as it seems to be a bug. Playing with a data model on 6.2.3, the regex filter of pivot seems to return a similar error no matter what the type of the field is. I wonder if the code implementing the data type check is a little off. On a 6.0.6 install, the regex filter of Pivot doesn't return an error, but it doesn't seem to do anything either.
I don't see a UI equivalent to a regex filter in the UI currently, but also there's a label on the documentation that the page is currently a work in progress so perhaps this is a feature under development?
It is probably just like the regex
command in the SPL so try it like this:
| pivot [...] Filter regex fieldname=".*"
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/regex
If you attempted this in a Splunk instance before posting, you would know that this syntax would get you: "Error in 'PivotProcessor': Could not parse pivot search. Search appears to be malformed." in 6.2.3 and "Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name regex was not found in object App_Request". See splunkd.log for more details" in 6.0.6