topic Re: ([^\/]+)\/ REGEX meaning? in Splunk Search

([^\/]+)\/ REGEX meaning?

Harishma — Thu, 03 Nov 2016 10:51:44 GMT

Can someone explain me wht that simple regex means??
Sorry for this simple question but this is very new to me. I understand these..
^ --> refers to start of / position
+--> means one or more
([^\/]+)\/

But this regex matches the below CAPITAL ONES for example:

AAAA/BBBB/CCCC/hhhh
Why hhhh is not matched? If ^\/ refers to start of position of "/", why things before the last slash ie before /hhhh are matched??

Appreciate your help on this.

Re: ([^\/]+)\/ REGEX meaning?

richgalloway — Thu, 03 Nov 2016 11:57:19 GMT

Within square brackets the '^' character means 'not'. Therefore, the regex matches at least one non-slash character followed by a slash.

Re: ([^\/]+)\/ REGEX meaning?

Harishma — Thu, 03 Nov 2016 14:20:32 GMT

Oh If thats the case , it should ignore AAAA and match /BBBB/CCCC/hhhh

(\/.+) would match like that right??

Whats the difference between this (\/.+) and ([^\/]+)\/

Re: ([^\/]+)\/ REGEX meaning?

Richfez — Thu, 03 Nov 2016 15:16:54 GMT

You can see a lot of this at what I've saved on regex101.com

Bit by bit,

(\/.+)
\/ is an escape, forward slash. The escape says the forward slash isn't a control character, but that you instead actually want a literal forward slash. . matches any one character, and the following + says "One or more of whatever immediately preceded this". So, all together, it'll look for a forward slash then one or more "somethings" following it.

([^\/]+)\/
[^\/] says to match characters that are NOT a forward slash. [] is for a character set, but when the first character inside it is ^ it flips it to NOT that character set. Following that is + so take one or more of those. Finally, the trailing \/ says it should be followed by a forward slash.

Again the regex101 link above has this, and if you study the explanation on the left it should vaguely match what I just wrote. 🙂

Also note the parenthesis are just to group things.

Re: ([^\/]+)\/ REGEX meaning?

inventsekar — Thu, 03 Nov 2016 15:30:53 GMT

\/ ------- will match for a "/"
^\/ ----- will match for a "/" at the beginning of the line.
[^\/] ------ ^ inside a [ ] will be for negation(opposite of). it will match for anything except a "/"
[^\/]+ ----- it will match for, one or more characters, anything except a "/"
([^\/]+)----- the rex matching should be put inside the flower bracket "( )".
([^\/]+)\/ --- the "\/" tells that, match till this "/". (it will match only AAAA or whatever before a first "/".)

Re: ([^\/]+)\/ REGEX meaning?

Harishma — Fri, 04 Nov 2016 07:09:53 GMT

Thankyuo so much 🙂 That helped..!!

Re: ([^\/]+)\/ REGEX meaning?

Harishma — Fri, 04 Nov 2016 07:11:06 GMT

Thankyuo so much 🙂 Got it ..

Re: ([^\/]+)\/ REGEX meaning?

lakromani — Fri, 04 Nov 2016 08:14:11 GMT

I think you do not need to escape the / inside [], so this will work as well.

([^/]+)\/