topic Splunk Regex Question in Splunk Search

Splunk Regex Question

NeonFlash — Thu, 26 Jul 2012 05:50:36 GMT

I want to list all the file names in a log file in Splunk whose name ends with, "_bn.txt"

Let's say the field name is path

so my regex looks like

regex path=".*_bn.txt$"

However, this does not list down the results.

But if I use the following regex:

regex path=".*.txt$"

I am able to see all the filenames which end in .txt.

Need to find all the file names ending in, _bn.txt

Thanks.

PS: I don't think underscore is a metacharacter which needs to be escaped.

Re: Splunk Regex Question

lguinn2 — Thu, 26 Jul 2012 06:54:10 GMT

Underscore is not a metacharacter, but the period is.

regex path=".*_bn\.txt$"

would be more accurate. But if there were files that ended in _bn.txt, the first regular expression still should have matched them...

So are you sure that there are any file names ending in _bn.txt in the time range that you are searching?

Re: Splunk Regex Question

Ayn — Thu, 26 Jul 2012 07:03:14 GMT

Also, where are you getting the field name path from? If you're talking about Splunk's field for showing the path of input files, that field's name is source.

Re: Splunk Regex Question

NeonFlash — Thu, 26 Jul 2012 08:03:45 GMT

Hi, yes, the regex worked. For some reason when I ran the splunk query for the first time, it did not work. Yes, I escaped the metacharacter with a backslash. @Ayn: In my case the field name is different 🙂