Splunk Search

How do I add this regex string to my search?

cj039165
New Member

Hello -

I have the search running below. How do I add "AAA*Y**80*" to the search?

Search:

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex "AAA*Y**42*"

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Like this
Update#2- per latest comment

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex _raw="(AAA.*Y.*42.*|AAA.*Y.*80.*)"

OR

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex _raw="(AAA.Y..42.*|AAA.Y..80.*)"

View solution in original post

gabriel_vasseur
Contributor

You'll get much better help if you clarify a number of things.
What does the * mean in your question? It doesn't seem to be the regular expression *. Your example has Y** which isn't a valid regex due to the two * in a row (that's what's causing the "nothing to repeat" error).
It would help a lot if you gave example of the things you want to match.
Also, you need to confirm if you want both your patterns to match or either. Is this an AND or an OR that you want?

0 Karma

cj039165
New Member

Sorry for the confusion. Our files contain what are called triple A errors. For this question there are two AAA errors that are showing up in a file. They are AAA*Y*41 and AAA*Y80. The asterix you see are delimiters in the files. That is exactly how the AAA error looks. I'm not using the asterix as wide cards. I know I have to regex around them, I'm having trouble adding two AAA errors into one search. I'm looking for AAA*Y41 OR AAA*Y*80. I want to find them both. Thanks.

0 Karma

cj039165
New Member

Sorry, I was not clear.

How I'm trying to search for AAA*Y*41 and AAA*Y*80 in a log file. I have to regex around both of these. I'm having trouble getting the two regex's into one search.

0 Karma

somesoni2
Revered Legend

Try the updated answer.

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex _raw= "AAA*Y*42"

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Regex

0 Karma

somesoni2
Revered Legend

Like this
Update#2- per latest comment

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex _raw="(AAA.*Y.*42.*|AAA.*Y.*80.*)"

OR

index=hdx_payer sourcetype=hdx_payer_receive_logs | regex _raw="(AAA.Y..42.*|AAA.Y..80.*)"

cj039165
New Member

I tried that. Here is the error I got:

Error in 'SearchOperator:regex': The regex '(AAA*Y*42|AAA*Y*80)' is invalid. Regex: nothing to repeat

0 Karma

somesoni2
Revered Legend

How about the the updated#2?

0 Karma

sundareshr
Legend

If the string has a literal char * you will have to escape it, like this

... | regex "AAA\*Y\*\*42\*"
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...