Splunk Search

How do you incorporate the following regex into a search?

nls7010
Path Finder

How can I get this in a regex that I can use in Splunk?

/[^aA-zZ].[0-9].log

I need to create an alert that looks at /home///log/*** and picks up only what matches the above string.

How can I put that in a search in Splunk?

Tags (2)
0 Karma

michael_schmidt
Path Finder

Try this:

source=/home///log/*| rex field=source "(?P[^aA-zZ].[0-9].log)"

Regardless, the command you need is the rex field=fieldname"regex_goes_here" part to get the regex working within the search.

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...