Splunk Search
Highlighted

Why am I not able to use the regular expression value of my main search in subsearch rex?

New Member

I tried to use the value of main search regex in subsearch rex .

Main search |rex "(?regular expression)"|append [search |rex "(?$val)"]
Main search |rex "(?regular expression)"|append [search |rex "(?regular expression)"]|search val=va1

both are not working. Please suggest what to do.

0 Karma
Highlighted

Re: Why am I not able to use the regular expression value of my main search in subsearch rex?

SplunkTrust
SplunkTrust

You can't pass value from outer search to subsearch. What is your requirement here (samples/current query/expected output)?

0 Karma
Highlighted

Re: Why am I not able to use the regular expression value of my main search in subsearch rex?

Esteemed Legend

You do this with the map command like this:

search to set val | rex "(?<val>RegExHere)" | map search="search $val"

Or reverse your logic like this:

search [search to set val | rex "(?<val>RegExHere)" | return $val]
0 Karma