topic Re: Regex AND Operator in Splunk Search

Regex AND Operator

subtrakt — Tue, 29 Sep 2020 18:10:07 GMT

I thought ?= acts like an AND operator.

Condition would be to capture words with >5 Upper-Case AND 4 Lower-Case and any other non-whitespace in the word.

Here's what i came up with - doesn't seem to work:
"s/(\S*[A-Z]{5,})(?=[a-z]{4,})\S*//g"

Would want it to capture strings like these:

adsdkdkDKDKDdkd:djkDKDK
ASaFaAdfkK-asdfoiA
asdfASDFF

I realized this actually works but doesn't work on words with non-consecutive A-Z. Any idea how to make it work with non-consecutive A-Z?

TEST1 doesn't work (non-consecutive):
| makeresults | eval TEST="AAAaAAaaaassdjkd" | rex field=TEST max_match=0 "(?\S*([A-Z]{5,})(?=[a-z]{4,})\S*)"

TEST1 Does work (consecutive AAAAAaaaa)
| makeresults | eval TEST="AAAAAaaaassdjkd" | rex field=TEST max_match=0 "(?\S*([A-Z]{5,})(?=[a-z]{4,})\S*)"

Re: Regex AND Operator

mayurr98 — Fri, 23 Feb 2018 03:13:42 GMT

Can you provide sample events and tell what do you want to extract it?
Also put the code in 10101 sample code format.

Re: Regex AND Operator

ibob0304 — Fri, 23 Feb 2018 05:52:31 GMT

can you please provide the sample output too ? I couldn't get the >5 part

Re: Regex AND Operator

subtrakt — Tue, 29 Sep 2020 18:10:31 GMT

"s/(\S*[A-Z]{5,})(?=[a-z]{4,})\S*//g"

I realized this actually works but doesn't work on words with non-consecutive A-Z. Any idea how to make it work with non-consecutive A-Z?

This would work AAAAAaaaassdjkd
This would not work AAaaAAaaaaasfd

Re: Regex AND Operator

subtrakt — Tue, 29 Sep 2020 18:10:34 GMT

TEST1 doesn't work (non-consecutive):
| makeresults | eval TEST="AAAaAAaaaassdjkd" | rex field=TEST max_match=0 "(?\S*([A-Z]{5,})(?=[a-z]{4,})\S*)"

TEST1 Does work (consecutive)
| makeresults | eval TEST="AAAAAaaaassdjkd" | rex field=TEST max_match=0 "(?\S*([A-Z]{5,})(?=[a-z]{4,})\S*)"

Re: Regex AND Operator

martin_mueller — Sun, 25 Feb 2018 00:37:50 GMT

Using the positive lookahead approach, ((?=(?:\S*[A-Z]){5,})(?:\S*[a-z]){4,}\S*) will match both cases. The match itself says "any non-space followed by a lower-case letter, at least four times - followed by any non-space" while the positive lookahead first asserts "any non-space followed by an upper-case letter, at least five times", no need to assert the followed-by part here.

Re: Regex AND Operator

subtrakt — Mon, 26 Feb 2018 15:42:31 GMT

Thanks Martin -

Came up with this solution as well but yours looks cleaner.

| makeresults | eval TEST="AAAaaAaaaa" | rex field=TEST max_match=0 "(?<TEST1>\S*(?=([a-z]*[A-Z]){4})(?=([A-Z]*[a-z]){6})[a-zA-Z]*\S*)"

Re: Regex AND Operator

subtrakt — Mon, 26 Feb 2018 15:48:00 GMT

One question regarding your non-capture groups. Are those for efficiency? I realized i can take out the ?: and it still works.