Splunk Search

extract field value/variable into regex

yuming1127
Path Finder

my search...... product_name="orange_wallet"
| fields product_name,productID
| rex field=tag_description "(?i)orange_wallet(?<description>\w+)(?<size>\w+)"
| table product_name,productID,description,size

My question is can we include a field values into the regex? Aim is to replace orange_wallet with <product_name> and it need to be case insensitive.

Thanks.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on.

Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want.

0 Karma

manjunathmeti
Champion

hi @yuming1127,

No, you cannot use field values in the regex. Instead of that, you can extract the product name into a separate field and compare it with the actual one.

 

my search...... product_name="orange_wallet"
| fields product_name,productID,tag_description
| rex field=tag_description "(?i)(?<product_name_rex>\w+)(?<description>\w+)(?<size>\w+)"
| where lower(product_name)=lower(product_name_rex)
| table product_name,productID,description,size

 

 

If this reply helps you, a like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...