topic Re: Splunk Filtering through regex in Splunk Search

Splunk Filtering through regex

machosplunker — Tue, 19 Mar 2013 18:02:34 GMT

I am trying to filtering results based on hosts which are our hbase zookeepers and region servers. There are 3 hbase clusters overall

Cluster1

test101
test102
test103
..
test116

Cluster2

test117
test118
..
test125

Cluster3

test126
..
test138

is it possible to filter these three clusters by regex by something like this. This is what i currently have to filter the first cluster it doesn't seem to be working.

host="test"|regex_raw="\b0[1]1[0-1]2[0-9]\b"

Re: Splunk Filtering through regex

machosplunker — Tue, 19 Mar 2013 18:05:47 GMT

i think ideal way might be filtering by specifying range like for cluster1 host="test"|"101-116", cluster2 host="test"|"117-125" not sure how to go about to get this.

Re: Splunk Filtering through regex

martin_mueller — Tue, 19 Mar 2013 19:39:53 GMT

I see two alternatives to regex-based filtering: You could either tag your hosts with cluster1, cluster2, and cluster3, or you could have a numeric field from 101 to 138 and filter using arithmetic comparators, ie cluster1 would be hostnumber>=101 AND hostnumber<=116. In fact, you can use the comparison operators with string ordering, but I'm not certain how efficient this would be: host>="test101" AND host<="test116"

Tagging likely is the most efficient way, and the splunkiest.

Re: Splunk Filtering through regex

machosplunker — Tue, 19 Mar 2013 20:45:56 GMT

that is so sweet!