Splunk Search

How to pass regular expression in variable to the match?


HI All,

     How to pass regular expression to the variable to match command? Please help..

in Following search query we need to pass the value for nonsupporting days dynamically based on the criteria.

| gentimes start=-1 | eval CreateDateEpoch="1412136000" | table CreateDateEpoch | eval start=relative_time(CreateDateEpoch,"@d") | eval end=relative_time(now(),"@d") | eval Date=mvrange(start,end+86400,86400) | convert ctime(Date) timeformat="%+" | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,"(Sun|Sat).*")))

eval nonsupport=if(value=1,"(Sun|Sat).*","(Mon|Sun).") | eval NoOfBusinessDays=mvcount(mvfilter(NOT match(Date,nonsupport*))

Sathish Rangan

Tags (3)
0 Karma

Esteemed Legend

You can either do this with a macro or with map. For an example of the latter, check out this answer:


0 Karma


A untested idea: put the variable name within single-quotes. ... | match(Date, 'nonsupport') ...

If this reply helps you, an upvote would be appreciated.
0 Karma


not working ;(

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!