Splunk Search

Using regex function with pattern stored in a variable

dave_krebs
Engager

I have dashboard panel with a dropdown menu on it. When the user selects a category from the dropdown, it will be stored in the variable $category$.

Based on the category selected by the user, I want to apply a regular expression to the "name" field in my search.

For example, if the user selects the category "category1", then I want to apply the regular expression "^(my|reg|ex)" to the "name" field in my search.

Here's what I tried:

sourcetype = mysourcetype | eval catregex = case(match($app_category$,"category1"),"^(my|reg|ex)" | regex name = catregex

This is not working. I'm thinking that the problem is with the command regex name = catregex

Maybe the field/variable that I created, catregex, is being interpreted as a string in that context? If so, how can I make sure it's interpreted as a variable?

I also tried something like this with regex command, but it seems this is not possible:

regex name = case(match($app_category$,"category1"),"^(my|reg|ex)"

Any help would be greatly appreciated!

Thanks, fellow Splunkers!

Tags (3)
0 Karma
1 Solution

dave_krebs
Engager

I eventually figured this one out. The fix is to put $app_category$ in double quotes:

eval mycategory="$app_category$"

View solution in original post

0 Karma

dave_krebs
Engager

I eventually figured this one out. The fix is to put $app_category$ in double quotes:

eval mycategory="$app_category$"

0 Karma

yannK
Splunk Employee
Splunk Employee

can you try to cast the variable in a field with an eval first ?

sourcetype = mysourcetype | eval mycategory=$app_category$ | eval catregex = case(match(mycategory,"category1"),"^(my|reg|ex)" | regex name = catregex

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...