topic Re: Using multiple REGEX in a single search in Splunk Search

Using multiple REGEX in a single search

shrirangphadke — Wed, 24 Jun 2015 23:12:54 GMT

Hi,

I want to use multiple REGEX in OR condition in a single search. For Ex:

REGEX 1: "VDL2PortPropSet.* : Failure" OR 
REGEX 2: "Vpxa.*Copied"  OR 
REGEX 3: "opswitch.+ Failed to find netstack 'opswitch'"

How can I achieve this? Sorry if my question is repeated.
Please help.

Re: Using multiple REGEX in a single search

rkent — Wed, 24 Jun 2015 23:16:28 GMT

You should be able to just put this in a single regex using the regex OR operator:

"VDL2PortPropSet.* : Failure|Vpxa.*Copied|opswitch.+ Failed to find netstack 'opswitch'"

I'll test this when I get to a system, but in the meantime give this a shot

Re: Using multiple REGEX in a single search

martin_mueller — Wed, 24 Jun 2015 23:18:13 GMT

For these simple examples you might even be fine without regex at all to speed up the search:

index=foo sourcetype=bar ("VDL2PortPropSet* : Failure" OR "Vpxa*Copied"  OR "opswitch* Failed to find netstack 'opswitch'") | rest of the search pipeline

Re: Using multiple REGEX in a single search

shrirangphadke — Wed, 24 Jun 2015 23:43:46 GMT

Hi martin_mueller,

Thanks for your answer. This kind of search did not work for me. Is it supported from Splunk version 6.2.1? I am using 6.1.8

Re: Using multiple REGEX in a single search

shrirangphadke — Wed, 24 Jun 2015 23:49:59 GMT

It worked ! Thank you very much

Re: Using multiple REGEX in a single search

martin_mueller — Wed, 24 Jun 2015 23:59:43 GMT

Wildcard searches have been part of Splunk since forever.

Re: Using multiple REGEX in a single search

shrirangphadke — Thu, 25 Jun 2015 00:02:13 GMT

Okey, that kind of search didn't work for me! Strange

Re: Using multiple REGEX in a single search

rkent — Thu, 25 Jun 2015 00:44:20 GMT

You're absolutely welcome