Splunk Search

How to use the field in search query EXTRACTED using REX command

rangineniarunku
Explorer

I have a field named "content" with multiple values to it as follows
content=value.deva
content=value.devb
" =value.devc ......
I have written a rex expression in my search query .........| rex field=Name ".(?.*)" to extract the Environment from the field content . Now I want to get the values in my result only for Environment=deva, how can I use the field Environment in my query?
I tried this way but it did not work ".........| rex field=content ".(?.)" | Environment=deva "

Can someone help me with this?

Tags (2)
0 Karma
1 Solution

DalJeanis
Legend

You are looking for the | where command.

| where Environment="myvalue" 

View solution in original post

DalJeanis
Legend

You are looking for the | where command.

| where Environment="myvalue" 

rangineniarunku
Explorer

It worked!!!

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...