Splunk Search

Field not fillled through eval in map

fvegdom
Path Finder

I have a search like this:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | map [search index="*" $keyword$ | eval kw=$keyword$, rex=$regex$ | regex($regex$)]

from some reason the kw field does not get a value, the kw field is displayed but It is always empty, if I look at search.log, I can see that the search is being parsed as:

( index="*" IBAN ) | eval kw=IBAN, rex="[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}" | regex ("[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}")

but in the results, rex does show a value, but kw does not. What am I missing here?

0 Karma
1 Solution

woodcock
Esteemed Legend

You need double-quotes, like this:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | map [search index="*" $keyword$ | eval kw="$keyword$", rex="$regex$" | regex($regex$)]

View solution in original post

woodcock
Esteemed Legend

You need double-quotes, like this:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | map [search index="*" $keyword$ | eval kw="$keyword$", rex="$regex$" | regex($regex$)]

fvegdom
Path Finder

aha, I understand, that also explains why the regex was already showing up in the results, it is already enclosed by double quotes in the original CSV.

works like a charm, thanks!

0 Karma

woodcock
Esteemed Legend

There are dangers to using the subsearch syntax ( [] ) instead of the normal double-quotes for map. It involves the fact that if your outer search is streaming (most likely), your subsearch will be restarted several times. If it does something like send an email with sendemail, you may find that it emails many times instead of the single time that you expected.

0 Karma

woodcock
Esteemed Legend

Show the output of this command:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | head 2
0 Karma

fvegdom
Path Finder

Thanks for looking into this, that search gives me:

IBAN             [a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}
AccountNumber    [a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...