topic Re: Simple Regex in search in Splunk Search

Simple Regex in search

balcv — Thu, 21 Feb 2019 04:59:37 GMT

I have a string of data that includes a field named user that has a value made up of domain\userid (eg prod\3245762 or tst\3245762 tst\smith) . I am wanting to write a search that can pull data based on a wildcard for the domain then only detect userid starting with 3,4 or 5).
I've tried index=* | rex field=user("*\\[3-5]*")
and various versions of. The majority return errors such as "...... is invalid", "Error in Search Operator:regex"

Can anyone shed some light on an appropriately formatted regex or rex statement please.

Re: Simple Regex in search

chrisyounger — Thu, 21 Feb 2019 05:02:30 GMT

Try this: index=* | rex "\\(?<username>[3-5]\w+)"

All the best

Re: Simple Regex in search

balcv — Tue, 29 Sep 2020 23:19:08 GMT

Still giving me the following error:

Error in 'rex' command: Encountered the following error while compiling the regex '*\(?<username>[3-5]\w+)': Regex: quantifier does not follow a repeatable item

What I though I was needing would be \ for the domain wildcard, then anything **starting* with 3,4 or 5 which could contain up to 7 or 8 characters. (eg tst\326541 or prod\456987)

So something along the lines of rex field=user "*\\([3-5]*")

Re: Simple Regex in search

chrisyounger — Thu, 21 Feb 2019 05:16:49 GMT

Try my latest one that I edited in: index=* | rex "\\(?<username>[3-5]\w+)"

Re: Simple Regex in search

chrisyounger — Thu, 21 Feb 2019 05:17:49 GMT

You can also try something more restrictive like this: index=* | rex "(?:prod|tst)\\(?<username>[3-5]\w+)"

Re: Simple Regex in search

vnravikumar — Thu, 21 Feb 2019 05:47:44 GMT

Hi @balcv

Try this

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | regex user="(.*)\\\([3-5][0-9]*$)"

Re: Simple Regex in search

vinod94 — Thu, 21 Feb 2019 09:04:37 GMT

Hi @balcv ,

Do you want something like this ....

Your search |  rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

this is a run anywhere search

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | fields - _time 
| rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

Re: Simple Regex in search

vnravikumar — Thu, 21 Feb 2019 12:45:25 GMT

@balcv, resolved?

Re: Simple Regex in search

paranjith — Thu, 21 Feb 2019 21:45:02 GMT

Try this:

index=* | rex field=user "(?P<domain>^.*)\\(?P<userid>[3-5].*$)"

This regex retrieves only the domain\userid where userid starts with either 3, 4 or 5 and any value for domain.

Hope this helps!!!

Re: Simple Regex in search

balcv — Thu, 21 Feb 2019 21:45:37 GMT

Thanks for your help. All good now.