Splunk Search

Combine two regular expressions into one

New Member

I want to combine two regular expressions.Please help me.

\b(2013)[- /.](0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])\b


[a-zA-Z0-9._%+-]+@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,6}:(?:[a-zA-Z0-9]{5,})

Thanx.

0 Karma

Ultra Champion

As has been suggested, some sample events would be good. Also, a clearer description of your use case would be nice, i.e. what do you want to achieve. From your comments above one could think that you want to search for events ranging between certain dates and extract the email addresses out of that.

Assuming that the '2013' part of the date you want to filter on, is part of the actual timestamp that splunk used for indexing your events, you can use the built-in time modifiers for searching;

index=blah earliest=-1y@y latest=@y | rex "\s(?<email>\S+@\S+)"

The regex used for extracting the email field in the example above is also quite simplified, mut may well work for you (depending on the contents of your events).

So, provide sample events and a clearer description of your desired outcome, and you'll get better help.

/K

0 Karma

New Member

@martin yes i want to commbine into AB.
That's what i am asking how should i do it?

@rsennett actually its a regex expression for email combos and date of only 2013 like 2013/9/24 or 2013/10/22.I want to combine both so that i could capture only 2013 email combos.Is it possible?

0 Karma

Splunk Employee
Splunk Employee

Also... if this is Splunk related you might want to share what you are trying to capture (give us a sample) and to what end you are wanting to combine the regex. Without knowing what you are trying to do, there is no way to help...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

Legend

What are you trying to do in Splunk? If this isn't Splunk-related, I suggest that you take the question to http://stackoverflow.com/

SplunkTrust
SplunkTrust

Okay, so you have regular expressions A and B, and "combine" them into regular expression AB.

How should AB behave?

0 Karma

New Member

it means write two into one.

0 Karma

SplunkTrust
SplunkTrust

What do you mean by "combine"?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!