Search for field range of numbers inside of case statement

[rberkheimer]

Greetings!

Hoping there is an easier way to write this sequential host list such as (host = "vlt(01 through 16)-she1") ?

| eval cde_model = case (
host = "vlt01-she1" OR host = "vlt02-she1" OR host = "vlt03-she1" OR host = "vlt04-she1" OR host = "vlt05-she1" OR host = "vlt06-she1" OR host = "vlt07-she1" OR host = "vlt08-she1" OR host = "vlt09-she1" OR host = "vlt10-she1" OR host = "vlt11-she1" OR host = "vlt12-she1" OR host = "vlt13-she1" OR host = "vlt14-she1" OR host = "vlt15-she1" OR host = "vlt16-she1", "cde-460-she1",

host = "vlt181-she1" OR host = "vlt182-she1" OR host = "vlt183-she1" OR host = "vlt184-she1" OR host = "vlt185-she1" OR host = "vlt186-she1" OR host = "vlt187-she1" OR host = "vlt188-she1" OR host = "vlt189-she1" OR host = "vlt190-she1" OR host = "vlt191-she1" OR host = "vlt192-she1" OR host = "vlt193-she1" OR host = "vlt194-she1" OR host = "vlt195-she1" OR host = "vlt196-she1" OR host = "vlt197-she1" OR host = "vlt198-she1", "cde-475-she1",

1=1, "oops"
)

[masonmorales · Accepted solution]

Try this:

| rex field=host (?<cde_model>vlt0*([1-9]|1[0-6])-she1)
| search cde_model=*

See also:
https://answers.splunk.com/answers/322170/how-to-use-regex-on-a-fields-value-in-a-search.html
https://answers.splunk.com/answers/327465/how-can-i-use-regex-with-wildcard-patterns-in-a-se.html

[rberkheimer]

Hmmm didn't think of rexing, thx for the input.

errors with:
Unknown search command '1'.