Splunk Search

([^\/]+)\/ REGEX meaning?

Harishma
Communicator

Can someone explain me wht that simple regex means??
Sorry for this simple question but this is very new to me. I understand these..
^ --> refers to start of / position
+--> means one or more
([^\/]+)\/

But this regex matches the below CAPITAL ONES for example:

AAAA/BBBB/CCCC/hhhh
Why hhhh is not matched? If ^\/ refers to start of position of "/", why things before the last slash ie before /hhhh are matched??

Appreciate your help on this.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Within square brackets the '^' character means 'not'. Therefore, the regex matches at least one non-slash character followed by a slash.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

inventsekar
Ultra Champion

\/ ------- will match for a "/"
^\/ ----- will match for a "/" at the beginning of the line.
[^\/] ------ ^ inside a [ ] will be for negation(opposite of). it will match for anything except a "/"
[^\/]+ ----- it will match for, one or more characters, anything except a "/"
([^\/]+)----- the rex matching should be put inside the flower bracket "( )".
([^\/]+)\/ --- the "\/" tells that, match till this "/". (it will match only AAAA or whatever before a first "/".)

Harishma
Communicator

Thankyuo so much 🙂 Got it ..

0 Karma

lakromani
Builder

I think you do not need to escape the / inside [], so this will work as well.

([^/]+)\/
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Within square brackets the '^' character means 'not'. Therefore, the regex matches at least one non-slash character followed by a slash.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Harishma
Communicator

Oh If thats the case , it should ignore AAAA and match /BBBB/CCCC/hhhh

(\/.+) would match like that right??

Whats the difference between this (\/.+) and ([^\/]+)\/

0 Karma

Richfez
SplunkTrust
SplunkTrust

You can see a lot of this at what I've saved on regex101.com

Bit by bit,

(\/.+)
\/ is an escape, forward slash. The escape says the forward slash isn't a control character, but that you instead actually want a literal forward slash. . matches any one character, and the following + says "One or more of whatever immediately preceded this". So, all together, it'll look for a forward slash then one or more "somethings" following it.

([^\/]+)\/
[^\/] says to match characters that are NOT a forward slash. [] is for a character set, but when the first character inside it is ^ it flips it to NOT that character set. Following that is + so take one or more of those. Finally, the trailing \/ says it should be followed by a forward slash.

Again the regex101 link above has this, and if you study the explanation on the left it should vaguely match what I just wrote. 🙂

Also note the parenthesis are just to group things.

Harishma
Communicator

Thankyuo so much 🙂 That helped..!!

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...