Splunk Search

Regex crash course?

Joffer
Path Finder

Can anyone recommend a good regex crash course article so I can learn how to write my (simple) whitelists and blacklists for my inputs.conf?

2 Solutions

Michael_Wilde
Splunk Employee
Splunk Employee

You might want to check out my video and some of the tools i use.

SplunkNinja - All My Regex's Live in Texas

View solution in original post

jangid
Builder
0 Karma

Alexandre_Nizou
Explorer

If you want to test your regular expressions on the spot, use the online http://www.regexpal.com/.

Take your REGEX and copy it in the first box, take the logs you are trying to match and copy them in the second box... et voila!

0 Karma

dwaddle
SplunkTrust
SplunkTrust

There's not much better on the topic than the O'Reilly book -- http://oreilly.com/catalog/9780596528126/ ... but this is not a "crash course" by any means, it is a full length discussion in great detail.

Given Splunk uses PCRE (Perl Compatible Regular Expressions) I find the "pcrepattern" man page at http://linux.die.net/man/3/pcrepattern to be a useful reference to the advanced features of PCRE.

saurabh_tek11
Communicator

Thanks @dwaddle - i was curious to know, what you answered - Splunk uses PCRE.

0 Karma

lguinn2
Legend

For people who like books, I suggest SAM's Teach Yourself Regular Expressions in 10 Minutes (Ben Forta)

It is reviewed on the regular-expressions info site http://www.regular-expressions.info/book10mins.html

0 Karma

Michael_Wilde
Splunk Employee
Splunk Employee

You might want to check out my video and some of the tools i use.

SplunkNinja - All My Regex's Live in Texas

Joffer
Path Finder

Sweet. RegexBuddy will probably help me alot 🙂

0 Karma

saurabh_tek11
Communicator

@MichaelWilde - kindly update the link, as its not opening now.

0 Karma

wollinet
Path Finder
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...