topic Re: My regex is not working in Splunk although it works at regex101.com in Splunk Search https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323055#M96408 <P>I would agree with @elliotproebstel !</P> Wed, 06 Dec 2017 20:25:51 GMT rphillips_splk 2017-12-06T20:25:51Z My regex is not working in Splunk although it works at regex101.com https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323052#M96405 <P>Hello,</P> <P>I have a field "group" these field contains some values with a prefix: "AD-". I need to get rid of the prefix.</P> <P>E.g <BR /> AD-test = test<BR /> ADtest = ADtest<BR /> test = test<BR /> AD-123 = 123<BR /> 123 = 123</P> <P>I am trying to do this with regex. My regex works fine outside of Splunk e.g at regex101.com or in a powershell script, but I am not able to get it work in splunk.</P> <P>This is my regex: [^AD-].<EM>\s<BR /><BR /> But in splunk | rex field="group" (?[^AD-].</EM>\s) results in: Missing a search command before '^'. ..... Error in 'SearchParser': errorcontext = [^AD-].*\s)}'.</P> <P>Udo</P> Wed, 06 Dec 2017 19:10:25 GMT https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323052#M96405 ugruner 2017-12-06T19:10:25Z Re: My regex is not working in Splunk although it works at regex101.com https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323053#M96406 <P>That's a great place to use the <CODE>replace</CODE> command:<BR /> <CODE>[your search] | replace "AD-*" with "*" in group</CODE></P> <P>Cleaner and easier than most regex!</P> Wed, 06 Dec 2017 19:31:24 GMT https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323053#M96406 elliotproebstel 2017-12-06T19:31:24Z Re: My regex is not working in Splunk although it works at regex101.com https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323054#M96407 <P>to clarify , you have 1 field called group and the value of the field needs AD- stripped off ? </P> <P>ie: <BR /> group = AD-test</P> <P>should be: </P> <P>group = test</P> Wed, 06 Dec 2017 20:16:01 GMT https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323054#M96407 rphillips_splk 2017-12-06T20:16:01Z Re: My regex is not working in Splunk although it works at regex101.com https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323055#M96408 <P>I would agree with @elliotproebstel !</P> Wed, 06 Dec 2017 20:25:51 GMT https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323055#M96408 rphillips_splk 2017-12-06T20:25:51Z Re: My regex is not working in Splunk although it works at regex101.com https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323056#M96409 <P>Thanks, I am always thinking too complicated.</P> Thu, 07 Dec 2017 07:52:29 GMT https://community.splunk.com/t5/Splunk-Search/My-regex-is-not-working-in-Splunk-although-it-works-at-regex101/m-p/323056#M96409 ugruner 2017-12-07T07:52:29Z