topic Re: Reqular Expression 101 in Splunk Search

Reqular Expression 101

rakeshksingh — Thu, 07 Sep 2017 22:12:14 GMT

Hi All,

I am a new to Regular Expression topic, Could you please share me a link which help me to understand Regular Expression for splunk ?

Re: Reqular Expression 101

MuS — Thu, 07 Sep 2017 22:51:31 GMT

Hi rakeshksingh,

Have a look at the docs here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/AboutSplunkregularexpressions and try the online regex tool called www.regex101.com which works perfect for Splunk regex. Another benefit of regex101.com is that it provides detailed explanation who and why it does match or does not match 😉

Hope this helps ...

cheers, MuS

Re: Reqular Expression 101

cpetterborg — Thu, 07 Sep 2017 23:08:03 GMT

Also watch Gabriel Vasseur's excellent presentation from last year's .conf:

http://conf.splunk.com/files/2016/recordings/become-a-regular-expressions-ninja-and-unlock-your-splunk-potential.mp4

With the accompanying PDF of the presentation found here:

http://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-potential.pdf

He does a tutorial on using regular expressions. Very helpful.

Re: Reqular Expression 101

woodcock — Fri, 08 Sep 2017 03:56:04 GMT

There are several different implementations of Regular Expression engines, all commonly called RegEx. Make sure that whatever you are reading/using is for Perl Compatible Regular Expressions, which is the flavor that Splunk uses.

Re: Reqular Expression 101

wrangler2x — Fri, 22 Sep 2017 20:45:06 GMT

The regex101.com site that @MuS mentioned has checkboxes on the left to select what "flavor" of regular expression to use. As @woodcock pointed out, Splunk uses Perl Compatible Regular Expressions (PCRE). Just make sure the PCRE box is checked on regex101.com and you are good to go.

In Splunk, flags can be added to regular expressions by preceding them with (?flag). So, if you are looking to parse multi-line logs, you can add (?m) to the beginning. On the regex101.com site, you'll find a flag symbol to the right of the regular expression box. Click on that flag and it has checkboxes for any flag you want to have set for that regular expression.

Besides all the other sources mentioned my MuS and other commenters, there is also a tutorial here:

http://www.regular-expressions.info/tutorial.html