Splunk Search

Regex Help

bcanfield83
Engager

Hello,

I'm attempting to use the regex command to filter out any records on the "user" field that do not match the written expression below:

index=myindex sourcetype=traceability_log4net earliest=-10d 
| regex _raw="user=[a-z]{3,6}[a-z1-9]{1,2}" 
| table user

Per the expression, there should not be any "user" records that exceed 8 characters. However, the non-matching values are not being filtered out.

"sstevenson6111", for example,  should theoretically be listed as "sstevens" per the expression.

regex_user-table.PNG

 I'm sure there's something blindingly obvious that I'm missing! 😳

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your regex is matching against the _raw field. It it looking for a string in the _raw field which could be anywhere in the _raw field matching the expression user=[a-z]{3,6}[a-z1-9]{1,2} , for example:

notuser=abc1@nowhere

user=sstevenson6111

All your examples match this expression

richgalloway
SplunkTrust
SplunkTrust

The regex command passes what matches the specified expression.  To filter them out, use !=.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...