Splunk Search

extract field value/variable into regex

yuming1127
Path Finder

my search...... product_name="orange_wallet"
| fields product_name,productID
| rex field=tag_description "(?i)orange_wallet(?<description>\w+)(?<size>\w+)"
| table product_name,productID,description,size

My question is can we include a field values into the regex? Aim is to replace orange_wallet with <product_name> and it need to be case insensitive.

Thanks.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have reduced your fields to just product_name and productID, so there is not tag_description field for the rex to work on.

Perhaps, if you could share some anonymised events that you want to extract the fields from, we might be able to find a way to get what you want.

0 Karma

manjunathmeti
Champion

hi @yuming1127,

No, you cannot use field values in the regex. Instead of that, you can extract the product name into a separate field and compare it with the actual one.

 

my search...... product_name="orange_wallet"
| fields product_name,productID,tag_description
| rex field=tag_description "(?i)(?<product_name_rex>\w+)(?<description>\w+)(?<size>\w+)"
| where lower(product_name)=lower(product_name_rex)
| table product_name,productID,description,size

 

 

If this reply helps you, a like would be appreciated.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...