topic Re: regex remove events from search in Splunk Search

regex remove events from search

brdr — Wed, 02 May 2018 14:25:27 GMT

I'm reading in events from a lookup table and I'm trying to remove events using RegEx that meet criteria but can't get it to work. I want to remove any host that is an IP address.

lookup file:
host
x.x.x.x
hosta
x.x.x.x
hostb

| inputlookup mylookup

| regex host!="/^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$/"
| table host

With this I still get all events. thx.

Re: regex remove events from search

xpac — Wed, 02 May 2018 14:32:03 GMT

Try this:

| inputlookup mylookup 
| regex host!="^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"
| table host

You just had to remove the / at the start and end 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Re: regex remove events from search

TISKAR — Wed, 02 May 2018 14:40:34 GMT

Hello,

You can also use the regex OR match function:

match:

   , | inputlookup mylookup 
     | where !match(host,"(\d{1,3}\.){3}\d+")
     | table host

Regex:

 | inputlookup mylookup 
 | regex host!="^(\d{1,3}\.){3}\d{1,3}$"
 | table host

Re: regex remove events from search

brdr — Wed, 02 May 2018 14:47:31 GMT

Thanks TISKAR, xpac for response!