How to apply a regex filter to my pivot?

[szabados]

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Pivot#Filter_element

According to this, there is a regex comparator usable with Filter.
I can't find any example, how should I use it.

What I've tried:

| pivot [...] Filter fieldname regex ".*"

But I get the following error:

Error in 'PivotProcessor': Error in 'PivotUtil': Cannot filter using 'regex' on field type 'string'

How can I apply a regex-filter to my pivot?

[acharlieh]

I would log a support request for this as it seems to be a bug. Playing with a data model on 6.2.3, the regex filter of pivot seems to return a similar error no matter what the type of the field is. I wonder if the code implementing the data type check is a little off. On a 6.0.6 install, the regex filter of Pivot doesn't return an error, but it doesn't seem to do anything either.

I don't see a UI equivalent to a regex filter in the UI currently, but also there's a label on the documentation that the page is currently a work in progress so perhaps this is a feature under development?

[woodcock]

It is probably just like the regex command in the SPL so try it like this:

| pivot [...] Filter regex fieldname=".*"

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/regex

[acharlieh]

If you attempted this in a Splunk instance before posting, you would know that this syntax would get you: "Error in 'PivotProcessor': Could not parse pivot search. Search appears to be malformed." in 6.2.3 and "Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name regex was not found in object App_Request". See splunkd.log for more details" in 6.0.6