match_regex
The match_regex function searches a text string for a specific pattern defined by a regular expression. It returns a bool value indicating whether the pattern was found in the text. This function is commonly used for pattern matching and validation tasks in text processing and data extraction.
Syntax
match_regex(Field, Regex)
Arguments
- Field: The field or String to match against.
- Regex: An RE2 regular expression as a String wrapped in forward slashes,
"/regex/".
Results
Returns a bool value, where matches are true and non-matches are false.
Examples
This example checks for source addresses that include the substring 42:
dataset="cribl_search_sample"
| where match_regex(srcaddr, "/42/")This example finds the Goats on the farm:
match_regex("Goats on a farm.", "/Goats/")This example looks for the substring is 2:
match_regex("Number is 2.000000", @'/is (\d+)/')