topic Re: Regex to start with specific characters in Splunk Search

Regex to start with specific characters

xvxt006 — Thu, 30 May 2013 16:54:10 GMT

Hi, i would like to get all the requests that start with / and there will be few alpha numeric characters and then ends with .css or .js, etc.

i have tried ^/*.(css|js) but did not work. Any suggestions?

Sample requests

/B387_38.css
/Globalfile.js

Re: Regex to start with specific characters

kristian_kolb — Thu, 30 May 2013 17:32:40 GMT

Well, you probably should not start the regex with a caret (^), unless you want to start your matching from the very beginning of the event. Also, there seems to be some confusion regarding regex wildcard characters.

* = match the preceding character zero or more times
. = match any character (once)

"slash, followed by a few alphanums, followed by dot, followed by either css or js" would look like;

/[A-Za-z0-9]+\.(js|css)

if you also want underscore to match in the filename, you can actually shorten the expression

/\w+\.(js|css)

Note, if you want to use the regex search command, you might need to specify more things, like a field to operate on, or quoting.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Regex

Re: Regex to start with specific characters

kristian_kolb — Thu, 30 May 2013 17:37:31 GMT

OOPS. A typo in the regexs. Fixed that now.

Re: Regex to start with specific characters

xvxt006 — Thu, 30 May 2013 18:56:12 GMT

Thank you Kristian. the pattern i gave is uri and it always starts with / so that is why i had ^. So if i wanted to start with should i just add ^ at the beginning for the regex expression.

When i use the regex you have given, i am getting

/mobile/m/shared/css/global.css
/js/grainger/addtocartajax.js

which is not the format i am looking for (/B387_38.css or
/Globalfile.js). Do you know what to change?

Re: Regex to start with specific characters

Ayn — Thu, 30 May 2013 19:57:36 GMT

Add the initial caret.

Re: Regex to start with specific characters

kristian_kolb — Thu, 30 May 2013 21:01:02 GMT

yep, if you use a field to operate on, the caret is relative to the field value.