topic Re: Regex help in Splunk Search

Regex help

vlape_SCWX — Wed, 01 Apr 2020 02:23:51 GMT

I am at a loss as to why the following is not working.
log:
2020-03-31 20:31:19,621 fail2ban.actions [709]: NOTICE [sshd] Unban 156.38.x.x
Query
index=main fail2ban.actions | regex _raw="[(?sshd)]" | fields jail
I have double checked the regular expression with regex101 and "sshd" is captured in group jail.
Am i missing something?
Splunk Enterprise 8.0.2.1

Re: Regex help

vlape_SCWX — Wed, 01 Apr 2020 02:25:28 GMT

For some reason the \ before [ was stripped when posting the question.

Re: Regex help

vnravikumar — Wed, 01 Apr 2020 05:01:55 GMT

Use Code Sample or press Ctrl +k while posting your query

Re: Regex help

niketn — Wed, 01 Apr 2020 07:19:15 GMT

@vlape_SCWX can you try something like the following:

index=main fail2ban.actions 
| rex "\[(?<jail>sshd)\]" 
| table jail _raw

Not sure what you want to pull with hard-coded sshd

Re: Regex help

to4kawa — Wed, 01 Apr 2020 13:15:47 GMT

 index=main fail2ban.actions sshd
| rex "\[(?<jail>[a-z]+)\]"
| fields jail

regex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
rex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

what do you want to do?
[is meta character.
your | regex _raw="[(?<jail>sshd)]" searches the word sshd

see following:

  \       general escape character with several uses
  ^      assert start of string (or line, in multiline mode)
  $      assert end of string (or line, in multiline mode)
  .      match any character except newline (by default)
  [      start character class definition
  |      start of alternative branch
  (      start subpattern
  )      end subpattern
  ?      extends the meaning of (
         also 0 or 1 quantifier
         also quantifier minimizer
  *      0 or more quantifier
  +      1 or more quantifier
         also "possessive quantifier"
  {      start min/max quantifier

https://www.pcre.org/original/doc/html/pcrepattern.html

Re: Regex help

vlape_SCWX — Wed, 01 Apr 2020 17:10:28 GMT

That worked! thanks you. Why is it when I search for the exact match it returns nothing?

Re: Regex help

to4kawa — Wed, 01 Apr 2020 18:49:30 GMT

regex is search, not field extract command.
so, field jail is missing.