topic Re: Online, interactive regular expression tester for Splunk regular expressions? in Splunk Search

Online, interactive regular expression tester for Splunk regular expressions?

stefanlasiewski — Thu, 01 Mar 2012 23:04:24 GMT

I am using the Interactive field extractor to try and extract certain fields. However, regular expressions are tricky and testing regular expressions on Splunk is slow.

Can anyone recommend a regular expression testing website which will work with Splunk regular expressions?

For example, http://regexpal.com/ (Written by Steven Levithan, coauthor of the Regular Expressions Cookbook works with certain regex flavors, but it doesn't always work with the regular expressions generated by the Splunk Interactive Field Extractor.

Re: Online, interactive regular expression tester for Splunk regular expressions?

lguinn2 — Fri, 02 Mar 2012 02:21:11 GMT

Splunk uses the PCRE flavor of regular expressions, so anything that is PCRE-compliant should work.

http://www.regular-expressions.info is a great site, and points to a variety of regular expression books, software and other resources.

Re: Online, interactive regular expression tester for Splunk regular expressions?

MHibbin — Fri, 02 Mar 2012 09:08:07 GMT

stefanlasiewski,

Someone on one of my Splunk courses (actually he was on both my Splunk courses), pointed me to the following site.. "http://gskinner.com/RegExr/".

It allows you test out some regular expressions, with some of your actual data. This is achieved with a simple "copy and paste" of you data into the window provided on the webpage. You can type in your own regex, or you can use the right-hand pane to look through the various "samples" if you are unsure.

It definately helped me the most when learning regex. It's hasn't always met my requirements, but it always helps in some way... worth a look. Plus from the looks of things, it provides more assistive features than the tool you mentioned.

Hope this helps,

MHibbin

P.S. If this answers you question please mark it as "Accepted", and/or upvote. Thanks

Re: Online, interactive regular expression tester for Splunk regular expressions?

MHibbin — Fri, 02 Mar 2012 09:08:41 GMT

Definately a useful site!

Re: Online, interactive regular expression tester for Splunk regular expressions?

fusednet — Fri, 12 Dec 2014 10:16:34 GMT

All of those don't support (?\w+) constructs. It isn't possible to test field extraction with those.

note: i'm not able to use angular brackets here.
( ? < field1 > \w+ )

Re: Online, interactive regular expression tester for Splunk regular expressions?

sherm77 — Wed, 24 Aug 2016 16:33:55 GMT

David Maislin told me about http://regex101.com several years ago, and it made a big difference for me. It's a great tool and everyone should use it (or try it) if you're learning regex. I hope this helps someone

Re: Online, interactive regular expression tester for Splunk regular expressions?

ClairmontSplunk — Wed, 16 Nov 2016 18:49:39 GMT

I've used this site for years and it helps me a lot with regex building. However, it seems that my applying it to Splunk seems to be failing miserably despite the regex being built properly.

Not sure if it's a pebkac issue or not though

Re: Online, interactive regular expression tester for Splunk regular expressions?

haraksin — Fri, 21 Mar 2025 00:07:02 GMT

It is absolute insanity that we continue to have this issue - Regex isn't that hard, but Splunk makes it harder by creating new rules and exceptions to those rules. Unfortunately this is why Splunk is in the position they are in - not user-friendly, and lack of proper GUI features that allow testing before integration.