Splunk Search

How to apply a regex filter to my pivot?

szabados
Communicator

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element

According to this, there is a regex comparator usable with Filter.
I can't find any example, how should I use it.

What I've tried:

| pivot [...] Filter fieldname regex ".*"

But I get the following error:

Error in 'PivotProcessor': Error in 'PivotUtil': Cannot filter using 'regex' on field type 'string'

How can I apply a regex-filter to my pivot?

Tags (3)
0 Karma

acharlieh
Influencer

I would log a support request for this as it seems to be a bug. Playing with a data model on 6.2.3, the regex filter of pivot seems to return a similar error no matter what the type of the field is. I wonder if the code implementing the data type check is a little off. On a 6.0.6 install, the regex filter of Pivot doesn't return an error, but it doesn't seem to do anything either.

I don't see a UI equivalent to a regex filter in the UI currently, but also there's a label on the documentation that the page is currently a work in progress so perhaps this is a feature under development?

woodcock
Esteemed Legend

It is probably just like the regex command in the SPL so try it like this:

| pivot [...] Filter regex fieldname=".*"

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/regex

0 Karma

acharlieh
Influencer

If you attempted this in a Splunk instance before posting, you would know that this syntax would get you: "Error in 'PivotProcessor': Could not parse pivot search. Search appears to be malformed." in 6.2.3 and "Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name regex was not found in object App_Request". See splunkd.log for more details" in 6.0.6

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...