topic Re: Regex - Ignore Whitespace in Splunk Search

Regex - Ignore Whitespace

vragosta — Mon, 18 Feb 2013 15:56:39 GMT

Is it possible to create a regex to ignore whitespace? Typically you can use /x to do this, but this does not seem to work in Splunk. I have also tried putting (?x) at the front of the regex, but this fails as well.

So, is there a modifier to ignore whitespace?

Also, is there any good documentation on all of the available regex modifiers within Splunk?

Thanks!

Re: Regex - Ignore Whitespace

rgcurry — Mon, 18 Feb 2013 17:10:42 GMT

From the Splunk Community Wiki, there is an article about this titled "RegEx Testing Tools" which starts with " Splunk uses Perl compatible regular expressions". This might help you with what you can and cannot use.

Have you tried using "\S+" (note the 's' is capitalized)? How about "(?!\s+)" for a negative lookahead?

Perhaps if you provide an example of your source for which you want this to work, someone can provide a sample RegEx to do what is wanted and needed.

Re: Regex - Ignore Whitespace

jonuwz — Mon, 18 Feb 2013 19:30:57 GMT

(?x) allows you to insert comments into your regex provided they're inbetween character classes examples

Re: Regex - Ignore Whitespace

jonuwz — Mon, 18 Feb 2013 19:33:15 GMT

where are the regexes ? in transforms.conf or in the rex search command ? Do you have an example ? how does it fail? Its feasible that transforms.conf is read line by line, so multi-line regexes would be garbled, but id expect errors on splunk start in that case