Splunk Search

How to pass regular expression in variable to the match?


HI All,

     How to pass regular expression to the variable to match command? Please help..

in Following search query we need to pass the value for nonsupporting days dynamically based on the criteria.

| gentimes start=-1 | eval CreateDateEpoch="1412136000" | table CreateDateEpoch | eval start=relative_time(CreateDateEpoch,"@d") | eval end=relative_time(now(),"@d") | eval Date=mvrange(start,end+86400,86400) | convert ctime(Date) timeformat="%+" | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,"(Sun|Sat).*")))

eval nonsupport=if(value=1,"(Sun|Sat).*","(Mon|Sun).") | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,nonsupport*))

Sathish Rangan

Tags (3)
0 Karma

Esteemed Legend

You can either do this with a macro or with map. For an example of the latter, check out this answer:


0 Karma


A untested idea: put the variable name within single-quotes. ... | match(Date, 'nonsupport') ...

If this reply helps you, an upvote would be appreciated.
0 Karma


not working ;(

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!