topic Re: Regex Help in Splunk Search

Regex Help

bcanfield83 — Sat, 01 Jan 2022 22:00:19 GMT

Hello,

I'm attempting to use the regex command to filter out any records on the "user" field that do not match the written expression below:

index=myindex sourcetype=traceability_log4net earliest=-10d | regex _raw="user=[a-z]{3,6}[a-z1-9]{1,2}" | table user

Per the expression, there should not be any "user" records that exceed 8 characters. However, the non-matching values are not being filtered out.

"sstevenson6111", for example, should theoretically be listed as "sstevens" per the expression.

I'm sure there's something blindingly obvious that I'm missing! 😳

Re: Regex Help

richgalloway — Sun, 02 Jan 2022 00:46:19 GMT

The regex command passes what matches the specified expression. To filter them out, use !=.

Re: Regex Help

ashvinpandey — Sun, 02 Jan 2022 05:50:37 GMT

@bcanfield83 This may help you: https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-filter-out-field-values/m-p/254358

Re: Regex Help

ITWhisperer — Sun, 02 Jan 2022 08:07:24 GMT

Your regex is matching against the _raw field. It it looking for a string in the _raw field which could be anywhere in the _raw field matching the expression user=[a-z]{3,6}[a-z1-9]{1,2} , for example:

notuser=abc1@nowhere

user=sstevenson6111

All your examples match this expression