topic Re: What is the meaning of my regular expression? in Splunk Search

What is the meaning of my regular expression?

namritha — Fri, 16 Sep 2016 20:12:06 GMT

Hi,

I used splunk to extract a new field and it has used this regular expression,

rex "^(?:[^\|\n]*\|){6}(?P<errorValue>.*)"

I have figured out that this checks for 6 occurrences of | and extracts the rest of the line.

What does ^(?:[^\|\n]* mean?

Also, what does .* at the end of (?P<errorValue>.*) mean?

Thanks in advance

Re: What is the meaning of my regular expression?

sundareshr — Fri, 16 Sep 2016 20:20:11 GMT

I pasted your regex here http://www.regex101.com and this is what I got back

^(?:[^\|\n]*\|){6}(?P<errorValue>.*)
^ represents start of the string 
(?:[^\|\n]*\|){6} Non-capturing group
Quantifier: {6} Exactly 6 times
[^\|\n]* match a single character not present in the list below
Quantifier: * Between zero and unlimited times, as many times as possible, giving back as needed [greedy]
\| matches the character | literally
\n matches a line-feed (newline) character (ASCII 10)
\| matches the character | literally

(?P<errorValue>.*) Named capturing group errorValue
.* matches any character (except newline)
Quantifier: * Between zero and unlimited times, as many times as possible, giving back as needed [greedy]
MATCH INFORMATION

Re: What is the meaning of my regular expression?

JoshuaJohn — Fri, 16 Sep 2016 20:28:17 GMT

I believe the first part is looking for the first instance(^) in your string but it is a non-capture group so it looks for all of it but doesn't put it into your variable (Looks for the 6 occurences of the |, but doesn't save it) (?:[^|] \n is line-feed new line.

.* = Matches anything until the end of the string

Re: What is the meaning of my regular expression?

namritha — Mon, 19 Sep 2016 16:12:10 GMT

Thanks Joshua and sundareshr.

Can you please tell me a few resources to learn regex?

Re: What is the meaning of my regular expression?

JoshuaJohn — Mon, 19 Sep 2016 16:16:50 GMT

I feel regex is an example based language there isn't a ton to learn in terms of the actual language but have a quick reference sheet like on a site like regex101.com or regexr.com

Then just takes log files from your splunk queries and try to create regex searches on those sites to grab specific information you want to take

Re: What is the meaning of my regular expression?

inventsekar — Mon, 19 Sep 2016 16:36:02 GMT

actually, from my own experience, if you learn Unix/Linux vi editor search and replace or sed command's search and replace, the regular expressions will become easy ( perl regular expressions as well )

grymoire is a good resource.. please check it..
http://www.grymoire.com/Unix/Sed.html

Re: What is the meaning of my regular expression?

aaraneta_splunk — Mon, 19 Sep 2016 22:47:24 GMT

Hi @namritha - If @JoshuaJohn or @sundareshr were helpful in answering your question, please don't forget to click on "Accept" below the best answer to resolve this post. Also, be sure to upvote any comments you found helpful too. Thanks! 🙂