Splunk Search

How to search for a pattern in logs using regex or rex

srinivas0704
New Member

I have following lines in logs

1 ADM.ADMX policies
Found ADM/ADMX policies

How do I search to filter only 1 ADM/ADMX policies?

0 Karma

to4kawa
Ultra Champion

you can't do that, because there is not 1 ADM/ADMX policies

| makeresults
| eval _raw="1 ADM.ADMX policies
Found ADM/ADMX policies"
| multikv noheader=t 
| table _raw
| regex "\d*\sADM\.ADMX\spolicies"

We can't answer that because that's not what you're talking about in the question and comment.
Check the results of regex before saying there is no result of stats.

0 Karma

sanjeev543
Communicator

@srinivas0704 Could you try index=foo | regex _raw="1\s+ADM\.ADMX\spolicies" if you need to match with 1 ADM.ADMX policies literally but if you need to capture string with any digit at the start you can try with index=foo | regex _raw="\d\s+ADM\.ADMX\spolicies"

0 Karma

srinivas0704
New Member

@sanjeev543 regex _raw="\d\s+ADM\/ADMX\spolicies"| stats count but still count shows as 0

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried index=foo "ADM/ADMX" or index=foo | regex "ADM\/ADMX"?

---
If this reply helps you, Karma would be appreciated.
0 Karma

srinivas0704
New Member

Hi I have tried first one,my intention is to take line which starts from digit and has ADM/ADMX

0 Karma

richgalloway
SplunkTrust
SplunkTrust

OK. I misunderstood the question. Try \d\sADM\/ADMX.

---
If this reply helps you, Karma would be appreciated.
0 Karma

srinivas0704
New Member

@richgalloway Not a problem regex _raw="\d\s+ADM\/ADMX\spolicies"| stats count ,but still count shows as 0

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a contradiction in what you want to find. Is it "1 ADM.ADMX policies" or "1 ADM/ADMX policies"? My latest response will find the latter. This should find the former: \d\sADM\.ADMX policies.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...