Splunk Search

How to apply a regex filter to my pivot?

szabados
Communicator

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element

According to this, there is a regex comparator usable with Filter.
I can't find any example, how should I use it.

What I've tried:

| pivot [...] Filter fieldname regex ".*"

But I get the following error:

Error in 'PivotProcessor': Error in 'PivotUtil': Cannot filter using 'regex' on field type 'string'

How can I apply a regex-filter to my pivot?

Tags (3)
0 Karma

acharlieh
Influencer

I would log a support request for this as it seems to be a bug. Playing with a data model on 6.2.3, the regex filter of pivot seems to return a similar error no matter what the type of the field is. I wonder if the code implementing the data type check is a little off. On a 6.0.6 install, the regex filter of Pivot doesn't return an error, but it doesn't seem to do anything either.

I don't see a UI equivalent to a regex filter in the UI currently, but also there's a label on the documentation that the page is currently a work in progress so perhaps this is a feature under development?

woodcock
Esteemed Legend

It is probably just like the regex command in the SPL so try it like this:

| pivot [...] Filter regex fieldname=".*"

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/regex

0 Karma

acharlieh
Influencer

If you attempted this in a Splunk instance before posting, you would know that this syntax would get you: "Error in 'PivotProcessor': Could not parse pivot search. Search appears to be malformed." in 6.2.3 and "Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name regex was not found in object App_Request". See splunkd.log for more details" in 6.0.6

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...