extract field value/variable into regex

[yuming1127]

my search...... product_name="orange_wallet"
| fields product_name,productID
| rex field=tag_description "(?i)orange_wallet(?<description>\w+)(?<size>\w+)"
| table product_name,productID,description,size

My question is can we include a field values into the regex? Aim is to replace orange_wallet with <product_name> and it need to be case insensitive.

Thanks.

[ITWhisperer]

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on.

Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want.

[manjunathmeti]

hi @yuming1127,

No, you cannot use field values in the regex. Instead of that, you can extract the product name into a separate field and compare it with the actual one.

my search...... product_name="orange_wallet"
| fields product_name,productID,tag_description
| rex field=tag_description "(?i)(?<product_name_rex>\w+)(?<description>\w+)(?<size>\w+)"
| where lower(product_name)=lower(product_name_rex)
| table product_name,productID,description,size

If this reply helps you, a like would be appreciated.