Splunk Search

Using a rex value in where statement

msarro
Builder

Hey everyone. In my data's filename there is an indicator which indicates the type of data that it is. It can either be "eu" or "cabs."
I am currently running into issues with this search:

index=cms| rex field=source "/home/cemp/CEMP/(?<EUORCABS>eu|cabs)/.*"|where EUORCABS=eu

It won't run. I have verified that the EUORCABS column is successfully created by running this search:

index=cms| rex field=source "/home/cemp/CEMP/(?<EUORCABS>eu|cabs)/.*"|table EUORCABS

All records have either a value of "eu" or "cabs" (without quotes). I have also tried casting it to a string, but no luck.

Am I missing something obvious here, or is splunk not searching properly?

Tags (2)

Lowell
Super Champion

I think the issue is with your "where" clause:

... | where EUORCABS=eu

This is evaluating the values of fields EUORCABS and eu. That's not what you want to do.

Either use

... | where EUORCABS="eu"

or

... | search EUORCABS=eu

Kate_Lawrence-G
Contributor

Hmm..

have you tried a stats values(EUORCABS) AS and then tried the where on that field?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...