Splunk Search

extract field value/variable into regex

yuming1127
Path Finder

my search...... product_name="orange_wallet"
| fields product_name,productID
| rex field=tag_description "(?i)orange_wallet(?<description>\w+)(?<size>\w+)"
| table product_name,productID,description,size

My question is can we include a field values into the regex? Aim is to replace orange_wallet with <product_name> and it need to be case insensitive.

Thanks.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on.

Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want.

0 Karma

manjunathmeti
Champion

hi @yuming1127,

No, you cannot use field values in the regex. Instead of that, you can extract the product name into a separate field and compare it with the actual one.

 

my search...... product_name="orange_wallet"
| fields product_name,productID,tag_description
| rex field=tag_description "(?i)(?<product_name_rex>\w+)(?<description>\w+)(?<size>\w+)"
| where lower(product_name)=lower(product_name_rex)
| table product_name,productID,description,size

 

 

If this reply helps you, a like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...