topic Re: Help with regex in Splunk Search

Help with regex

bosseres — Thu, 16 Dec 2021 09:46:16 GMT

Hello everyone,

I need help with regex

I have search

index=*
| regex Commandline="my_regular_expression"

How can I add one more regular expression with OR condition?

something like this | regex Commandline="my_regular_expression" OR | regex Commandline="my_regular_expression2"

Tahnk you

Re: Help with regex

aasabatini — Thu, 16 Dec 2021 09:52:31 GMT

Hi @bosseres

the OR condition on regular expression is the pipe "|",

I show you an example

rex filed=_raw "\w+\s+(?<name_field>\w+|\w+\d+)"

Re: Help with regex

javiergn — Thu, 16 Dec 2021 09:53:23 GMT

Hi @bosseres ,

You could try with the following:

index=* | regex Commandline="(keyword1|keyword2)"

But if you can tell us exactly what sort of regex you want to implement we might be able to assist a bit more.

Regards,

Javier

Re: Help with regex

bosseres — Thu, 16 Dec 2021 10:37:31 GMT

Thank you very much for responding, and what if I have such condition?

| regex Commandline="my_regular_expression" | (regex Commandline="my_regular_expression2" AND regex Commandline="my_regular_expression3" )

(AND added)

Re: Help with regex

javiergn — Thu, 16 Dec 2021 10:45:30 GMT

Hi again,

I couldn’t say. There are many ways to do it. If you can be a bit more specific about your regex I might be able to help more.

Translating Boolean operators to regex is not trivial and it is not what regex was designed for originally.

You can replicate an OR the way I told you earlier. You can replicate an AND by simply doing a second regex after the first one but also within the same regular expression assuming the text you want to match follows that order.

In summary, if you can give us an example of what you are trying to match we could probably help you a lot more.

Re: Help with regex

bosseres — Thu, 16 Dec 2021 11:10:39 GMT

I have 3 regex expressions - regex1, regex2, regex

and I need to find events where field Commandline matches regex1 or matches regex2 AND regex3

regex1 OR (regex2 AND regex3)

is it possible? thank you

Re: Help with regex

javiergn — Thu, 16 Dec 2021 12:00:29 GMT

It will look like the following:

index=YOURINDEXHERE | regex Commandline="(regex1|regex2.*regex3)"

But I could be wrong as I still don't know what sort of regex you want to write or what kind of string you want to match. Hope it helps anyway.