topic Re: Regex search help in Splunk Search

Regex search help

nangrosso — Mon, 24 May 2021 16:00:57 GMT

I was asked to " update a search to append a final ' | regex PatternStringMatch="[A-Z]" query that will look for anything in that field that has both a letter and a number. Any thoughts?

Re: Regex search help

ITWhisperer — Mon, 24 May 2021 16:43:47 GMT

| regex PatternStringMatch="\w"

Re: Regex search help

nangrosso — Mon, 24 May 2021 19:21:25 GMT

Thanks for the response but I ran the search it gave me nothing. Any idea what the "W" represents

Re: Regex search help

ITWhisperer — Mon, 24 May 2021 21:55:00 GMT

backslash lower case w means numbers and letters. upper case letters means not numbers and letters. So, the regex will keep events where the field has letters or numbers. Is this not what you wanted?

Re: Regex search help

yuanliu — Tue, 25 May 2021 09:11:32 GMT

The OP ask is "has both a letter and a number" (underline is mine). "\w" will match any single character that is not a "punctuation", so "a" (no number), "1" (no letter), "___" (no letter or number), "a_b_c_", "1_2_3_", etc., will all match. The following will match "both a letter and a number":

| regex PatternStringMatch="[a-zA-Z].*\d|\d.*[a-zA-Z]"

Re: Regex search help

ITWhisperer — Tue, 25 May 2021 09:47:59 GMT

You are right, the specification is ambiguous - \w with match both a letter and a number (and non-punctuation).

Re: Regex search help

nangrosso — Tue, 25 May 2021 14:37:07 GMT

Thanks for the detailed explanation