Splunk Search

Pattern match on two different fields

tnkoehn
Path Finder

I am performing a search where I want to find events if one of two fields matches a specific pattern (which is the same for both fields). I've tried regex, but it doesn't seem to like an OR operator.

search traffic | transaction Acct_ID startswith="START" endswith="STOP" | regex Egress="^\w{3}\d{4}" OR regex Ingress="^\w{3}\d{4}"

Is there any way to do this?

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I believe you are close, however since regex drops events, I'd go a different path and use some matching in eval. Try this:

search traffic | transaction Acct_ID startswith="START" endswith="STOP"| eval ematch=if(match(Egress,"^\w{3}\d{4}"),1,0)|eval imatch=if(match(Ingress,"^\w{3}\d{4}"),1,0)|where ematch>0 OR imatch>0

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I believe you are close, however since regex drops events, I'd go a different path and use some matching in eval. Try this:

search traffic | transaction Acct_ID startswith="START" endswith="STOP"| eval ematch=if(match(Egress,"^\w{3}\d{4}"),1,0)|eval imatch=if(match(Ingress,"^\w{3}\d{4}"),1,0)|where ematch>0 OR imatch>0

alacercogitatus
SplunkTrust
SplunkTrust

Thanks! Just doing my part to help!

0 Karma

Rob
Splunk Employee
Splunk Employee

+1 @alacercogitatus Really nice way of avoiding using the regex command and using the eval functions instead. My solutions would have been to use rex to grab things out.

0 Karma

tnkoehn
Path Finder

You are a rock star! Works great. Thanks!

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...