Splunk Search

Execute regex based on condition

vaishnavi07
Explorer

I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and for other sourcetype(PerfmonMk:Processor) i have to display the counters starting with % only. I use the following regex commands,

Counters starting with # and % : |  regex column="#[_A-Za-z]*|%[_A-Za-z]*"
Counters starting with % : |  regex column="%[_A-Za-z]*"

Is there any way to do this?

Tags (1)

grijhwani
Motivator

Just construct the one regex to match all your cases. I can't see what the issue is with matching [#%][_A-Za-z]* (which is just a contraction of your first example regex). If hash is never present, what's the big deal? The regex will still match.

0 Karma

aweitzman
Motivator

OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:

sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]

The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.

0 Karma

vaishnavi07
Explorer

Hi Can you please give me an example?

0 Karma

aweitzman
Motivator
  1. You could use the single regex as described, and then use a 'where' clause to eliminate the events you don't want.

  2. You could run two different searches with your two different regexes and use 'append' to turn them into a single result set.

0 Karma

vaishnavi07
Explorer

If i write single regex command and select sourcetype as "PerfmonMk:Processor" then the counters starting with # will get displayed. I don't need that. Only if i select the sourcetype "PerfmonMk:.Net CLR Exceptions" the counters that starts with # should get displayed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...