I've never used |regex, but use |where match() quite often. Is the former just syntax sugar or is there any difference?
Is this confirmation that the implementation is different? The question is about language (as opposed to efficiency or suitability for a given use case), and I feel is an answerable one, unlike a question about, say, two seemingly equivalent regular expressions.
Hi @yuanliu
did you mean rex command?
rex command give you the possibility to extract field in search time
https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Rex
eval match it's just to put regex on condition
anyway the scope are different
Regards
Alessandro
@aasabatini wrote:did you mean rex command?
Not rex. regex.