topic Why isn't this regex returning anything? in Splunk Search

Why isn't this regex returning anything?

ashnet16 — Tue, 11 Nov 2014 22:50:21 GMT

When running the regex below, the search doesn't return any results even though the reg ex string works well on the external regex builder I use. Help.

Here's the original string: \.(.{2,4}\s+?)

Here's the spunk search: index=*|fields file | rex field=file "(?\.(.{2,4}\s+?))" | stats count(Asset) AS "Total" by Asset | sort -Total

Re: Why isn't this regex returning anything?

musskopf — Tue, 11 Nov 2014 22:52:57 GMT

Could you provide some of your RAW data? The content of field "file" should be enough.

Re: Why isn't this regex returning anything?

musskopf — Tue, 11 Nov 2014 22:56:48 GMT

The first error is here:

(?.(.{2,4}s+?))

you have (? and ) at the start and end... that doesn't look right.

Also, to use the rex command, you need to use Named Capturing group in the regex, like:

.(?P<test>.+)

Where test will be the name of the field extracted.

Re: Why isn't this regex returning anything?

ashnet16 — Tue, 11 Nov 2014 22:58:12 GMT

Here is some raw data:

vcard.png
phone.png

style.css

jquery.colorbox-min.js

Thanks!!

Re: Why isn't this regex returning anything?

musskopf — Tue, 11 Nov 2014 23:00:03 GMT

Ok, and is that a single line? or multiple entries? Also, what are you trying to extract?

Re: Why isn't this regex returning anything?

ashnet16 — Tue, 11 Nov 2014 23:01:28 GMT

This is the Splunk search Format for rex: (?...) (.....)equals the regular expression.

Re: Why isn't this regex returning anything?

kristian_kolb — Wed, 12 Nov 2014 07:49:45 GMT

Hi,

please provide real data,
describe what you are trying to achieve,
use the code markup where appropriate, since this help with formatting and special characters

If you got a good answer, vote up a/o mark as answered.

Re: Why isn't this regex returning anything?

sves — Wed, 12 Nov 2014 08:08:02 GMT

Hi ashnet16,

As Kristian says, we need some real data and also exactly what you try to extract from that data.

With that said, your original rex | rex field=file "(?\.(.{2,4}\s+?))" does not look right.

If you want to convert your original regular expression \.(.{2,4}\s+?) to rex, I would expect it to look something like this:

| rex field=file ".(?<fieldname>.{2,4}\s+?)"

Cheers!

#Sven Emil