topic Re: Regex help, using ^ character in Splunk Search

Regex help, using ^ character

AttarSingh1 — Mon, 12 Sep 2022 19:47:19 GMT

Hey,

I was trying to filter some search data in splunk using regex. I was able to figure the regex part. However when I try to input into splunk, i get an error.
Error in 'SearchParser': Missing a search command before '\'. Error at position '321' of search query 'search index=nessus [ search index=nessus ...{snipped} {errorcontext = <paths>^([\w]+[^\w\r\}'.

Splunk command : | rex field=pluginText (?<paths>^([\w]+[^\w\r\n]+){2}[\w]+)

regex link : regex101: build, test, and debug regex

Re: Regex help, using ^ character

scelikok — Mon, 12 Sep 2022 19:51:14 GMT

@AttarSingh1,

You should put the regex expression into double quotes like below;

| rex field=pluginText "(?<paths>^([\w]+[^\w\r\n]+){2}[\w]+)"

Re: Regex help, using ^ character

AttarSingh1 — Mon, 12 Sep 2022 20:01:48 GMT

Thanks that did take care of the error, but my variable isnt storing value.

Re: Regex help, using ^ character

AttarSingh1 — Mon, 12 Sep 2022 20:04:53 GMT

Do you have any ideas on how to set regex flags /gm, in splunk. Unsure if you need to. but thats what regex101 made me do. so maybe thats the missing piece

Re: Regex help, using ^ character

scelikok — Mon, 12 Sep 2022 21:07:26 GMT

Hi @AttarSingh1,

Please try below;

| rex max_match=0 field=pluginText "(?m)(?<paths>^([\w]+[^\w\r\n]+){2}[\w]+)"

Re: Regex help, using ^ character

AttarSingh1 — Mon, 12 Sep 2022 21:56:22 GMT

can you explain what the (?m) does

everything works with this. thanks a bunch

Re: Regex help, using ^ character

scelikok — Tue, 13 Sep 2022 03:57:30 GMT

Hi @AttarSingh1,

Nice to hear everything works.

(?m) is the (?<option_flag>) construct allows you to set various matching properties like case-insensitivity, multiline, greedy,

The "m" flag is for multiline data.