topic regex delimiters & config file formatting in Splunk Search

regex delimiters & config file formatting

Gregory_Lapchen — Thu, 10 Feb 2011 05:40:01 GMT

I'm experiencing a subtle issue, which is not very apparent due to lack of delimiters around regular expressions, where the space after the '=' sign is being parsed as part of the regular expression. Considering most config files use spaces around the '=' sign for readability, this becomes confusing.

REGEX = info

This expression would match " info" vs "info". I.e. "abc info" would match, and "abcinfo" would not.

Is this expected behavior?

Re: regex delimiters & config file formatting

gkanapathy — Thu, 10 Feb 2011 07:15:03 GMT

You can either use \s (which would match either a space or a tab) or [ ] (just the space) in a regex to represent a space, and it's usually a good idea to do so if you've got it at the beginning of a regex. I wonder if you might prefer to use \b (word boundary) before the info as well.

Re: regex delimiters & config file formatting

Boopalan — Fri, 26 Apr 2019 07:13:47 GMT

Below Regex will work as expected for you:
REGEX=\s+info

Re: regex delimiters & config file formatting

aojie654 — Fri, 26 Apr 2019 08:34:58 GMT

Hi, @Gregory Lapchenko:

I'll use _ in this answer to recognize space.
I feel sorry about that I'm not very clearly to understand your puzzle. From what I understand, are you want to match just _info but not abc_info? If so, maybe the regex expression is \s+info to match _info, or [^\s]*?\sinfo to match abc_info.