topic Re: How to write a Regex to search globally? in Splunk Search

How to write a Regex to search globally?

onthakur — Tue, 17 May 2022 14:55:33 GMT

below is the data which has multiple features for a single item. I want to write a regex which could search all occurrences of feature (not just first occurance) and then count the feature . I have written below search string but count value is not consistent. can someone plz take a look and advice.

Many thanks in advance.

|makeresults
| eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"},
{\"\"feature\"\": \"\"INTDATA2\"\"},
{\"\"feature\"\": \"\"MGDAT0\"\"},
{\"\"feature\"\": \"\"MGPR2TI\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"PNINCLWAP\"\"},
{\"\"feature\"\": \"\"PRMCAFIND\"\"},
{\"\"feature\"\": \"\"3WY\"\"},
{\"\"feature\"\": \"\"CFC\"\"},
{\"\"feature\"\": \"\"CFU\"\"},
{\"\"feature\"\": \"\"CLIP\"\"},
{\"\"feature\"\": \"\"CLIR\"\"},
{\"\"feature\"\": \"\"CLW\"\"},
{\"\"feature\"\": \"\"DATA\"\"},
{\"\"feature\"\": \"\"CAMTAC\"\"},
{\"\"feature\"\": \"\"HOLD\"\"},
{\"\"feature\"\": \"\"INROAM\"\"},
{\"\"feature\"\": \"\"ISP\"\"},
{\"\"feature\"\": \"\"MSTORE\"\"},
{\"\"feature\"\": \"\"NWROAM\"\"},
{\"\"feature\"\": \"\"PERMGL\"\"},
{\"\"feature\"\": \"\"SMSO\"\"},
{\"\"feature\"\": \"\"VM\"\"},
{\"\"feature\"\": \"\"GFLEX\"\"}]"
|rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}"
|stats count(feature) by feature

Re: How to write a Regex to search globally?

somesoni2 — Tue, 17 May 2022 15:26:49 GMT

Try like this

|makeresults | eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"}, {\"\"feature\"\": \"\"INTDATA2\"\"}, {\"\"feature\"\": \"\"MGDAT0\"\"}, {\"\"feature\"\": \"\"MGPR2TI\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"PNINCLWAP\"\"}, {\"\"feature\"\": \"\"PRMCAFIND\"\"}, {\"\"feature\"\": \"\"3WY\"\"}, {\"\"feature\"\": \"\"CFC\"\"}, {\"\"feature\"\": \"\"CFU\"\"}, {\"\"feature\"\": \"\"CLIP\"\"}, {\"\"feature\"\": \"\"CLIR\"\"}, {\"\"feature\"\": \"\"CLW\"\"}, {\"\"feature\"\": \"\"DATA\"\"}, {\"\"feature\"\": \"\"CAMTAC\"\"}, {\"\"feature\"\": \"\"HOLD\"\"}, {\"\"feature\"\": \"\"INROAM\"\"}, {\"\"feature\"\": \"\"ISP\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"NWROAM\"\"}, {\"\"feature\"\": \"\"PERMGL\"\"}, {\"\"feature\"\": \"\"SMSO\"\"}, {\"\"feature\"\": \"\"VM\"\"}, {\"\"feature\"\": \"\"GFLEX\"\"}]" |rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}"| mvexpand feature |stats count(feature) by feature

Re: How to write a Regex to search globally?

onthakur — Wed, 18 May 2022 08:47:46 GMT

thank you that works.