regex vs where match()

[yuanliu]

I've never used |regex, but use |where match() quite often.  Is the former just syntax sugar or is there any difference?

[isoutamo]

Basically both are doing the same thing. You should use job inspector to check which one perform better for your case.

[yuanliu]

Is this confirmation that the implementation is different?  The question is about language (as opposed to efficiency or suitability for a given use case), and I feel is an answerable one, unlike a question about, say, two seemingly equivalent regular expressions.

[aasabatini]

Hi @yuanliu 

did you mean rex command?

rex command give you the possibility to extract field in search time

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Rex

eval match it's just to put regex on condition

anyway the scope are different

Regards

Alessandro

[yuanliu]

---

@aasabatini wrote:

did you mean rex command?

---

Not rex.  regex.