Splunk Search

Is it possible to define tags using regex?

Path Finder

I would like to define a tag in splunk using a regex.

Example:
host=st1231, host=1232, host=1233 --> the name of the tag should be "foo"
host=st1234, host=1235, host=1236, host=1237 -> the name of the tag should be "bar"

Is it possible to define these tags above using a regex? Or do I have to define for each host its own tag?

Tags (3)
0 Karma

New Member

You can dow this with Python also.,Ya its You can dow with this This is a known problem with regex - you can't match pairs. Matching is either greedy, in which it matches the last one it finds, or non-greedy, in which it matches the first. You can't persuade a regex to count opening and closing brackets.

I would recommend loading it into a DOM and using that. If you are trying to implement an HTML parser, I would recommend using regex to lex it, then a left-right parser to parse the output of your lexer.

0 Karma

Esteemed Legend

The only way that you can do any wildcarding is to use * in an eventtype definition and then you create a tag with a value like this:

eventtype=<Your eventtype Name Here>`

Even so, you cannot use pipes | in your eventtype so you are cannot use the RegEx-ish commands like regex, so this is not really an answer, other than to assure you that there is no answer.

0 Karma

Communicator

@woodcock, I tried creating an event type, but it wouldn't let me include search commands in the event type. I'm on 6.4.3.

Can you help me understand why this is the case?

0 Karma

Esteemed Legend

I have clarified my answer.

0 Karma

Path Finder

Thanks for your answer!

Would it be possible to make a list of hosts in a tag?
Example: host=(st1231 OR host=1232 OR host=1233) as tag "foo"?

0 Karma

Esteemed Legend

No, but

1: You can use a list in your eventtype. If you are using the GUI, when you create an eventtype with a search string, there is place to assign it a tag name, too.
2: You can create multiple tag definitions, one-by-one, recycling the same tag name, one for each host KVP.

0 Karma

Legend

Don't believe tags support wildcards or regex. Alternatively you could use search macros and regex. Something like this should work

[foo]
definition = index=st123* | regex host="st123[1-3]"

[bar]
definition = index=st123* | regex host="st123[4-7]"

In your search, you could use

`foo` 

OR 

`bar`
0 Karma

Path Finder

Thanks for your answer!

Would it be possible to make a list of hosts in a tag?
Example: host=(st1231 OR host=1232 OR host=1233) as tag "foo"?

0 Karma

Path Finder

The regex should look like: host=st123[1-3] for "foo" and host=st123[4-7] for "bar"

0 Karma

Splunk Employee
Splunk Employee

Tags CAN be created with wildcards:
   Settings > Tags > All unique tag objects > New Tag:
 Tag name = privileged_user
 Field name = user
 Field value = admin

Search: tag=privileged_user (will find admin, sysadmin, adminsap, etc)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!