topic Re: Regex help in Splunk in Splunk Search

Regex help in Splunk

Shashank_87 — Wed, 27 Mar 2019 11:59:06 GMT

Hi, I have few events in splunk like these -
1. "GET /test/materials/components/fields HTTP/1.1"
2. "GET /test1 HTTP/1.1" OR "GET /test2 HTTP/1.1
Now what i want is just to see the events which are like in the 2nd point. My query should ignore the 1st one's. The 2nd type of URL has a pattern that it has only one word after "/".

Can some one help?

Re: Regex help in Splunk

ehowardl3 — Wed, 27 Mar 2019 12:18:31 GMT

As far the regex goes, the following will only match the examples in point 2:

\w+\s\/\w+\s.*

-E

Re: Regex help in Splunk

Shashank_87 — Wed, 27 Mar 2019 13:02:57 GMT

Hi ehoward, Thank you for the response. Is there a way to exclude this in the search itself? I mean within the search query can we exclude all the URL's apart from the one's who follow pattern as 2nd point. This way we reduce the overhead and number of events

Re: Regex help in Splunk

somesoni2 — Wed, 27 Mar 2019 14:12:05 GMT

This is the full raw data OR full value of field??

your base search | regex _raw=".+\"\w+\s+\/\S+\s+\w+\/\d+\.\d+\".+"

OR if the extracted field name is URL

your base search | regex URL="\w+\s+\/\S+\s+\w+\/\d+\.\d+"

Re: Regex help in Splunk

Shashank_87 — Wed, 27 Mar 2019 15:11:14 GMT

Hi Somesoni2, The above 2 points which i mentioned are 2 different events in my index. What i want is to fetch only 2nd type of events and exclude the 1st one's.
What will be the query look like?

Re: Regex help in Splunk

somesoni2 — Wed, 27 Mar 2019 15:27:03 GMT

My solution is considering type 2 events. Try the same.

Re: Regex help in Splunk

ragedsparrow — Wed, 10 Apr 2019 01:45:00 GMT

You can not exclude with a regex pattern in your base search. You have to put it through the regex transformation to exclude events in the search via regex pattern matching. Example:

base search | regex url="\w+\s\/\w+\s.*"

That would only match the 2nd example shown

If you don't need the events at all, you may want to consider routing them to the nullQueue: https://docs.splunk.com/Documentation/Splunk/7.2.5/Forwarding/Routeandfilterdatad

The 2nd option will allow you to send specific events that you do not want to the nullQueue and they are not indexed. If you want it all to be indexed and then filtered at search time, you will need to use the regex specific transformation commands to filter them out.