Splunk Search

Using regex function with pattern stored in a variable

dave_krebs
Engager

I have dashboard panel with a dropdown menu on it. When the user selects a category from the dropdown, it will be stored in the variable $category$.

Based on the category selected by the user, I want to apply a regular expression to the "name" field in my search.

For example, if the user selects the category "category1", then I want to apply the regular expression "^(my|reg|ex)" to the "name" field in my search.

Here's what I tried:

sourcetype = mysourcetype | eval catregex = case(match($app_category$,"category1"),"^(my|reg|ex)" | regex name = catregex

This is not working. I'm thinking that the problem is with the command regex name = catregex

Maybe the field/variable that I created, catregex, is being interpreted as a string in that context? If so, how can I make sure it's interpreted as a variable?

I also tried something like this with regex command, but it seems this is not possible:

regex name = case(match($app_category$,"category1"),"^(my|reg|ex)"

Any help would be greatly appreciated!

Thanks, fellow Splunkers!

Tags (3)
0 Karma
1 Solution

dave_krebs
Engager

I eventually figured this one out. The fix is to put $app_category$ in double quotes:

eval mycategory="$app_category$"

View solution in original post

0 Karma

dave_krebs
Engager

I eventually figured this one out. The fix is to put $app_category$ in double quotes:

eval mycategory="$app_category$"

0 Karma

yannK
Splunk Employee
Splunk Employee

can you try to cast the variable in a field with an eval first ?

sourcetype = mysourcetype | eval mycategory=$app_category$ | eval catregex = case(match(mycategory,"category1"),"^(my|reg|ex)" | regex name = catregex

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...