This page explains how to use the indexof_regex function in APL.
indexof_regex
function to find the position of the first match of a regular expression in a string. The function is helpful when you want to locate a pattern within a larger text field and take action based on its position. For example, you can use indexof_regex
to extract fields from semi-structured logs, validate string formats, or trigger alerts when specific patterns appear in log data.
The function returns the zero-based index of the first match. If no match is found, it returns -1
. Use indexof_regex
when you need more flexibility than simple substring search (indexof
), especially when working with dynamic or non-fixed patterns.
Splunk SPL users
match()
in Splunk SPL to perform regular expression matching. However, match()
returns a Boolean, not the match position. APL’s indexof_regex
is similar to combining match()
with additional logic to extract position, which is not natively supported in SPL.ANSI SQL users
REGEXP_LIKE
for Boolean evaluation. indexof_regex
provides a more direct and powerful way to find the exact match position in APL.Name | Type | Required | Description |
---|---|---|---|
string | string | Yes | The input text to inspect. |
match | string | Yes | The regular expression pattern to search for. |
start | int | The index in the string where to begin the search. If negative, the function starts that many characters from the end. | |
occurrence | int | Which instance of the pattern to match. Defaults to 1 if not specified. | |
length | int | The number of characters to search through. Use -1 to search to the end of the string. |
-1
.
The function returns null
in the following cases:
start
value is negative.occurrence
value is less than 1.length
is set to a value below -1
.indexof_regex
to detect whether the URI in a log entry contains an encoded user ID by checking for patterns like user-[0-9]+
.Query_time | id | uri | user_id_pos |
---|---|---|---|
2025-06-10T12:34:56Z | user42 | /api/user-12345/settings | 5 |
2025-06-10T12:35:07Z | user91 | /v2/user-6789/dashboard | 4 |