Onetime regex search

[Avarion]

Hi,

I'm struggling with doing a regex search.

I want to search the whole log files for credit card information. Since its not necessary in a field I want to do it as a full search.

Unfortunately I don't get Splunk to even make the easiest regex search.

For example:

index="ABC" regex _raw="INFO"
index="ABC" regex field=_raw "INFO"

result empty. INFO is in nearly every third _raw Field.

It does not change when I exchange regex with rex.

I'm sure its something very simple unfortunately I seem to be unable to find it.

[Avarion]

Ah, Thank you. I've searched for examples before but they were all missing the Pipe character.

I understand your concerns. But the INFO was only a example. I will add there the regex for the credit card search.

[Avarion]

Ah, Thank you. I've searched for examples before but they were all missing the Pipe character.

I understand your concerns. But the INFO was only a example. I will add there the regex for the credit card search.

[Ayn]

It seems to me you should take the Splunk search tutorial (http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ). The searches you're running now are looking for the literal string "regex". You could do

index="ABC" | regex _raw="INFO"

which is probably what you were after, but that would have horrible performance, because it would tell Splunk to grab ALL events in the index ABC from disk before passing them on to the regex command. It would be MUCH better to do

index="ABC" INFO

because that would make Splunk grab only the events that actually contain the word "INFO" from disk. Always try to put as many terms in your base search as possible - it enables Splunk to limit the events that need to be read from disk, which leads to better performance.

[Avarion]

Ah, Thank you. I've searched for examples before but they were all missing the Pipe character.

I understand your concerns. But the INFO was only a example. I will add there the regex for the credit card search.