Splunk Search

regex vs where match()

yuanliu
SplunkTrust
SplunkTrust

I've never used |regex, but use |where match() quite often.  Is the former just syntax sugar or is there any difference?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Basically both are doing the same thing. You should use job inspector to check which one perform better for your case.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Is this confirmation that the implementation is different?  The question is about language (as opposed to efficiency or suitability for a given use case), and I feel is an answerable one, unlike a question about, say, two seemingly equivalent regular expressions.

0 Karma

aasabatini
Motivator

Hi @yuanliu 

 

did you mean rex command?

rex command give you the possibility to extract field in search time

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Rex

eval match it's just to put regex on condition

anyway the scope are different

Regards

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@aasabatini wrote:

did you mean rex command?


Not rex.  regex.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...