Splunk Search

How to pass regular expression in variable to the match?

Contributor

HI All,

     How to pass regular expression to the variable to match command? Please help..

in Following search query we need to pass the value for nonsupporting days dynamically based on the criteria.

| gentimes start=-1 | eval CreateDateEpoch="1412136000" | table CreateDateEpoch | eval start=relative_time(CreateDateEpoch,"@d") | eval end=relative_time(now(),"@d") | eval Date=mvrange(start,end+86400,86400) | convert ctime(Date) timeformat="%+" | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,"(Sun|Sat).*")))

Ex:
eval nonsupport=if(value=1,"(Sun|Sat).*","(Mon|Sun).") | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,nonsupport*))

Thanks
Sathish Rangan

Tags (3)
0 Karma

Esteemed Legend

You can either do this with a macro or with map. For an example of the latter, check out this answer:

https://answers.splunk.com/answers/386488/regex-in-lookuptable.html

0 Karma

SplunkTrust
SplunkTrust

A untested idea: put the variable name within single-quotes. ... | match(Date, 'nonsupport') ...

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Contributor

not working ;(

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!