topic Re: good regex (fast) in Splunk Search

good regex (fast)

mcbradford — Wed, 13 Nov 2013 18:51:22 GMT

I have a field called "user". I am looking for matches that contain 6 or 7 characters, and always end with "a" but does not end in "pa".

I am using the following and it works, but I was wondering if someone might have a better regex expression that would be faster?

regex user=".+[^p]a$"

Re: good regex (fast)

somesoni2 — Wed, 13 Nov 2013 19:32:24 GMT

I don't have data to test it but this is also an options.

| where LIKE(user,"%a") AND NOT LIKE(user,"%pa")

Re: good regex (fast)

jtrucks — Wed, 13 Nov 2013 20:54:03 GMT

Technically, your regex will match any length string that starts with at least one character followed by the letter 'a' (as end of string) without a letter 'p' coming before that letter 'a'. This means that it would match user="1a" or user="mydata" or user="my other data here a" so if you need to restrict to only a full string length of 6 or 7 characters, you are really looking for regex that looks for "5 or 6 of any character, followed by a letter 'a' to end the string, as long as there is not a letter 'p' immediately before the last letter 'a'" right?

Perhaps this will work:

^.{5,6}(a|[^p]a)$

Re: good regex (fast)

mcbradford — Wed, 13 Nov 2013 21:34:06 GMT

This found besmanager???

Re: good regex (fast)

mcbradford — Wed, 13 Nov 2013 21:34:49 GMT

This worked, but it is about as fast as my originally regex.

Re: good regex (fast)

jtrucks — Wed, 13 Nov 2013 21:41:35 GMT

Hmm. odd. I edited the entry to show string termination at the end. I don't have data in splunk to test this exact string, so it might need some tweaking. The above IS pure PCRE syntax, however. If you don't care the length of the string, your regex is perfectly fine and fast enough…

Re: good regex (fast)

jgreenleaf — Wed, 13 Nov 2013 21:58:00 GMT

^.{5,6}(?<!p)a$

should do what you want

Re: good regex (fast)

tpflicke — Wed, 13 Nov 2013 23:01:44 GMT

Just a hint how to quickly test some regular expressions without having the data in splunk using eval - the examples below show tests against the regex given by jgreenleaf

index=* | head 1 | eval user="12345pa" | regex user="^.{5,6}(?<!p)a$" | table user

index=* | head 1 | eval user="123456a" | regex user="^.{5,6}(?<!p)a$" | table user