Splunk Search

how to compare regex with string, which are two different fields in my search query output.

annamareddi
New Member

i have a regex pattern in my .CSV file. Pattern1= A$B$C|K$L$M|X$Y$Z. where "$" is a variable like date and ID
each pattern is tagged to a unique number. Unique number=123 for Pattern1.
i tried to split the pattern1 in my search by pipe(|) using eval split command.
i need first(_raw) for these splitted patterns.
my output is

unique number splitted_pattern (_raw)
123 A$B$C ABC
KLM
XYZ

123 K$L$M ABC
KLM
XYZ

123 X$Y$Z ABC
KLM
XYZ
but i need a output as

unique number splitted_pattern (_raw)
123 A$B$C ABC
123 K$L$M KLM
123 X$Y$Z XYZ

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Add this to your search:

|mvexpand splitted_pattern

It works for me when I generate the data like this:

| makeresults count=1 | eval csv="123,ABC|KLM|XYZ" | rex field=csv "(?<uniqnum>\d+),(?<patterns>.*)" |  eval splitted_pattern=split(patterns,"|") | mvexpand splitted_pattern
0 Karma

inventsekar
SplunkTrust
SplunkTrust

can you write us your current query please.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...