topic Re: Is there any way of searching for any character follow by comma using rex in Splunk Search

Is there any way of searching for any character follow by comma using rex

rajivchadha — Wed, 18 Jan 2017 11:33:21 GMT

Does splunk rex have a concept of doing a .*, in the rex function? I basically want to search for any character followed by a comma.

javiergn — Wed, 18 Jan 2017 11:44:52 GMT

Does "any character" include commas too?

If not, you can possibly do it like this:

"[^\,]+\,"

Which reads as 1 or more non-comma characters followed by a comma.

You can then group all of that in a token you want to capture, and problem solved.

| rex "(?<fieldnameFoo>[^\,]+)\,"

Thanks,
J

jkat54 — Wed, 18 Jan 2017 12:13:44 GMT

In regex . stands for any character and \, stands for comma.

  | rex (?<anyChar>.)\,

Should work

However if you're not wanting to extract the field and instead you're just searching for it, use the regex command.

   | regex .\,

rajivchadha — Wed, 18 Jan 2017 12:29:33 GMT

Thanks. I tried what you suggested and it worked.

rajivchadha — Tue, 29 Sep 2020 12:24:26 GMT

I tried the rex command like below and it did not work as per your suggestion

index="md_dev" ( "Subscribe for") | rex max_match=0 "(?identifier=.*\,)"

also tried

index="md_dev" ( "Subscribe for") | rex max_match=0 "(?identifier=[.]*\,)"

which did not work