Where are variables in splunk defined

Question

I have an alert setup in splunk which uses below search string.

index="someapp" sourcetype = "some:app" "some_scheduler" "ERROR" 
| regex source = "(lambda:prod)"

I am not able to find where (lambda:prod) is defined. This search query works globally so I am assuming it's not something defined at app level or something.

Answer 1

(lambda:prod) is not defined anywhere. It is a literal string interpreted as a regular expression. That regex is used to match against the results returned by the commands prior to regex. Any event with a source field which matches the regex will be included in the results and all other events will be filtered.