topic What sort of regular expressions does splunk use? in Splunk Search

What sort of regular expressions does splunk use?

msarro — Tue, 22 Mar 2011 21:25:13 GMT

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

Re: What sort of regular expressions does splunk use?

ftk — Tue, 22 Mar 2011 21:36:39 GMT

PCRE

Re: What sort of regular expressions does splunk use?

gkanapathy — Tue, 22 Mar 2011 22:00:15 GMT

also useful: http://www.pcre.org/

Re: What sort of regular expressions does splunk use?

msarro — Wed, 23 Mar 2011 01:50:52 GMT

Great, thank you!

Re: What sort of regular expressions does splunk use?

scorrie_splunk — Wed, 06 Jun 2018 17:36:32 GMT

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

Re: What sort of regular expressions does splunk use?

niketn — Wed, 06 Jun 2018 18:14:46 GMT

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions

Re: What sort of regular expressions does splunk use?

gjanders — Wed, 06 Jun 2018 22:35:58 GMT

That link does not work are you referring to "About Splunk Regular Expressions" ?

Re: What sort of regular expressions does splunk use?

niketn — Thu, 07 Jun 2018 01:17:28 GMT

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions

Re: What sort of regular expressions does splunk use?

scorrie_splunk — Thu, 07 Jun 2018 15:31:44 GMT

Yes, I pasted the wrong one, and have fixed it. Thanks