topic Re: regex matched data only in Splunk Search

regex matched data only

mkarimi — Thu, 08 May 2014 21:22:32 GMT

I have a regex which looks for any event that has the repid=XXXX where XXXX is some number

"mysearch | rex repid=(?<REP_ID>\d+)"

I need to display data that only matches that criteria. for example none of these should be shown:

repid
or 
repid=
or 
repid%s20=
or
repid-1245

Re: regex matched data only

yannK — Thu, 08 May 2014 22:11:53 GMT

Your example is not valid, please avoid the confusion between :

the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

Re: regex matched data only

mkarimi — Fri, 09 May 2014 13:26:22 GMT

awesome! thanks for the help. is it possible to make the repid in regex _raw="repid=\d+" case insensitive? the reason is that there might be some cases of RepID or repiD, etc.

Re: regex matched data only

mkarimi — Fri, 09 May 2014 14:12:39 GMT

got that to by using (?i) in regex _raw="(?i)repid=\d+"