topic Re: Regex crash course? in Splunk Search

Regex crash course?

Joffer — Wed, 28 Jul 2010 17:34:08 GMT

Can anyone recommend a good regex crash course article so I can learn how to write my (simple) whitelists and blacklists for my inputs.conf?

Re: Regex crash course?

wollinet — Wed, 28 Jul 2010 18:05:43 GMT

Have a look at:

http://www.regular-expressions.info/

Re: Regex crash course?

Michael_Wilde — Thu, 29 Jul 2010 03:17:52 GMT

You might want to check out my video and some of the tools i use.

SplunkNinja - All My Regex's Live in Texas

Re: Regex crash course?

Joffer — Thu, 29 Jul 2010 14:34:25 GMT

Sweet. RegexBuddy will probably help me alot 🙂

Re: Regex crash course?

lguinn2 — Thu, 12 Aug 2010 15:38:45 GMT

For people who like books, I suggest SAM's Teach Yourself Regular Expressions in 10 Minutes (Ben Forta)

It is reviewed on the regular-expressions info site http://www.regular-expressions.info/book10mins.html

Re: Regex crash course?

dwaddle — Sun, 05 Sep 2010 05:34:07 GMT

There's not much better on the topic than the O'Reilly book -- http://oreilly.com/catalog/9780596528126/ ... but this is not a "crash course" by any means, it is a full length discussion in great detail.

Given Splunk uses PCRE (Perl Compatible Regular Expressions) I find the "pcrepattern" man page at http://linux.die.net/man/3/pcrepattern to be a useful reference to the advanced features of PCRE.

Re: Regex crash course?

Alexandre_Nizou — Tue, 02 Nov 2010 02:03:47 GMT

If you want to test your regular expressions on the spot, use the online http://www.regexpal.com/.

Take your REGEX and copy it in the first box, take the logs you are trying to match and copy them in the second box... et voila!

Re: Regex crash course?

jangid — Wed, 06 Jun 2012 11:32:55 GMT

This is also good small document to learn

http://api.ning.com/files/k-J0BUJLASFKKlDVrodtWvdSn3lDz02U5nlTTuovnU0Fjn4Gt6JNy0YjAS2sYjhC93bhNT02kDMqz0pAMyiUmrkC7IB2fsxR/splunkfieldextractionsmakingregexyourbuddy110818212008phpapp02.pdf

Re: Regex crash course?

saurabh_tek11 — Tue, 05 Dec 2017 10:01:09 GMT

Thanks @dwaddle - i was curious to know, what you answered - Splunk uses PCRE.

Re: Regex crash course?

saurabh_tek11 — Tue, 05 Dec 2017 10:04:57 GMT

@MichaelWilde - kindly update the link, as its not opening now.