search using a regex

alexl1 — Wed, 18 Dec 2013 02:45:51 GMT

hi, if I want to find events using a regex what is the syntax?

e.g if I want all events with either big or bag is there a way to use a regex like b.g

thanks,

Re: search using a regex

alexl1 — Wed, 18 Dec 2013 03:00:08 GMT

I found it

regex _raw="b.g"

Re: search using a regex

grijhwani — Wed, 18 Dec 2013 04:09:49 GMT

Actually, to find answer specific example the regex would in fact be "b[ai]g". Your example would find any combination of three printable characters starting with "b" and ending with "g", and would also return such things as "b-g", "bog", "b4g", etc...

Furthermore, your example would match anything containing words with a similar sequence, such as "begin", "bogus", "abigail", etc...

If you want to limit to complete words only you will need the start/end of word markers (< and >), which in the context of the config file may also require escaping with "\", as in this example:

regex _raw="\<b[ai]g\>"

topic Re: search using a regex in Splunk Search

search using a regex

Re: search using a regex

Re: search using a regex