Splunk Search

PCRE Regex not working in Splunk

eprince
New Member

Required API call, RegEx i tried in https://regex101.com/ and the Regex which works in Splunk are given below.

/Contact/v1/15965755/Order
\/Contact\/v1\/[0-9]{1,}/Order
/Contact/v1/*/Order

Why PCRE regex not working in Splunk? If i add $ at the end to limit the search, that also not working.
Somebody please throw some light on this.

Thanks...

0 Karma

woodcock
Esteemed Legend

Be aware that RegEx101.com does not start our in PCRE mode, you have to SET IT THAT WAY by selecting the PCRE (PHP) option under the Flavors menu in the left pane! Also note on the very right edge of the RegEx text input it shows some REGEX FLAGS of which g and m are set by default but only the g is always correct for Splunk. For example, rex and regex commands DO NOT use m by default (but LINE_BREAKER does), so you must prefix your RegEx with (?m) to make it work the same way in Splunk (or de-select the m flag on RegEx101.com).

Also be aware that splunk has both pcregextest and regextest CLI tools that you can use:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/CLIadmincommands

jpolvino
Builder

I like to keep things simple with lookaround constructs. Very powerful, easy to maintain, and worth exploring for cases like this.

| rex "(?<orderNum>\d+)(?=\/Order)"

Translation: Grab the numbers that precede /Order. See https://regex101.com/r/Qq2qaV/1

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="/Contact/v1/15965755/Order" 
| rex field=temp "(?P<result>\d+[^\/])"
0 Karma

mydog8it
Builder

Line #2 is missing an escape on the backslash preceding "/Order".

Try this:
\/Contact\/v1\/[0-9]{1,}\/Order

to4kawa
Ultra Champion

That's right.

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="/Contact/v1/15965755/Order"
| rex "(?<=\/)(?<value>\d+)"

Hi, @eprince
Some strange signs may be in it, so what about this?

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

What isn't working for you?

| makeresults 
|  eval data = "/Contact/v1/15965755/Order"
| rex field=data "^\/Contact\/v1\/(?<field>[0-9]{1,})/Order$"
0 Karma

eprince
New Member

\/Contact\/v1\/[0-9]{1,}/Order is not working in Splunk to return /Contact/v1/15965755/Order.
But its working in RegEx101 online validation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...