Splunk Search

regex vs where match()

yuanliu
SplunkTrust
SplunkTrust

I've never used |regex, but use |where match() quite often.  Is the former just syntax sugar or is there any difference?

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Basically both are doing the same thing. You should use job inspector to check which one perform better for your case.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Is this confirmation that the implementation is different?  The question is about language (as opposed to efficiency or suitability for a given use case), and I feel is an answerable one, unlike a question about, say, two seemingly equivalent regular expressions.

0 Karma

aasabatini
Motivator

Hi @yuanliu 

 

did you mean rex command?

rex command give you the possibility to extract field in search time

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Rex

eval match it's just to put regex on condition

anyway the scope are different

Regards

Alessandro

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@aasabatini wrote:

did you mean rex command?


Not rex.  regex.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...