Splunk Search

Efficiency of REGEX = . vs REGEX = .* vs REGEX = (.*)

chris_barrett
Communicator

Which of the following (in terms of the REGEX) is the most efficient? I've seen examples of all of them. And is there an even more efficient REGEX?

[send_to_nullQueue_dot]
SOURCE_KEY = _raw
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[send_to_nullQueue_dot_star]
SOURCE_KEY = _raw
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

[send_to_nullQueue_dot_plus]
SOURCE_KEY = _raw
REGEX = .+
DEST_KEY = queue
FORMAT = nullQueue

[send_to_nullQueue_dot_star_lazy]
SOURCE_KEY = _raw
REGEX = .*?
DEST_KEY = queue
FORMAT = nullQueue

[send_to_nullQueue_captured_dot_star]
SOURCE_KEY = _raw
REGEX = (.*)
DEST_KEY = queue
FORMAT = nullQueue

Tags (2)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

A single dot matches any single character that is in the input line. That's the fastest, most effective one.

All the other ones are more complicated than that, so would be slightly slower.

. any single character
.* zero or more characters but scan all of them
.+ one or more characters but scan all of them
.+? zero or more characters, scan up to all of them but be wishy washy about it
(.*) zero or more characters, scan all of them, but collect the whole thing as a field and then do nothing with it.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

A single dot matches any single character that is in the input line. That's the fastest, most effective one.

All the other ones are more complicated than that, so would be slightly slower.

. any single character
.* zero or more characters but scan all of them
.+ one or more characters but scan all of them
.+? zero or more characters, scan up to all of them but be wishy washy about it
(.*) zero or more characters, scan all of them, but collect the whole thing as a field and then do nothing with it.

0 Karma

to4kawa
Ultra Champion

Matching is all different.
if it works, . is best.
but it works?

0 Karma

PavelP
Motivator

Most efficient in regard of speed? You can test your regexes with https://regex101.com/ and compare "number of steps" shown right on top of the regex field.

REGEX = . doesn't make sense because it matches any pattern.

My bet: fixed case-sensitive pattern with static quanitifiers anchored to beginning of the line? 🙂

There are a lot of information about regexes on World Wide Web, hier is splunk focused: https://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-...

chris_barrett
Communicator

In hindsight, I should have said that the value of _raw was irrelevant as the decision to not index the event was being made on the basis of either the host, source or sourcetype. So the transforms stanza was really just about setting the queue to nullQueue.

And thank you for the link to the Conf presentation. I had seen it before but it was good to go over it again.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...