topic Re: how to match multiple regex in splunk? in Splunk Search

how to match multiple regex in splunk?

szone — Sat, 11 Sep 2021 16:18:41 GMT

hi all,

how can i write it? please help me.

Re: how to match multiple regex in splunk?

ITWhisperer — Sat, 11 Sep 2021 16:39:54 GMT

Without knowing what you are actually trying to capture (some example events would be useful), it is difficult to say how it can be fixed, but in simple terms, a lot of the capture groups have not been closed, so simply adding some closing parentheses will make the regex valid, although it may not give you what you want

Re: how to match multiple regex in splunk?

szone — Sat, 11 Sep 2021 17:11:02 GMT

i want to capture strings matched with that regex and the regex is from good source and don't need to closing parentheses and i write part of the entire of string for summarize and example.
please help me.

Re: how to match multiple regex in splunk?

ITWhisperer — Sat, 11 Sep 2021 17:19:10 GMT

Rather than using non-capture groups (?:pattern) use capture groups (?<fieldname>pattern)

Re: how to match multiple regex in splunk?

szone — Sat, 11 Sep 2021 18:22:25 GMT

Re: how to match multiple regex in splunk?

isoutamo — Mon, 13 Sep 2021 08:06:47 GMT

as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex.

r. Ismo