Splunk Search

Regex field != expression not matching

raghav130593
Explorer

I have a query where I am performing regex matching on two different fields, field1 and field2. index=proxylogs uri!=aa.*|regex field1=".*abc\..*|.*api\..*"|regex field2!="(?i)abc\\xyz[a-z0-9]{5}|(?i)abc\\kkr[a-z0-9]{6}"|.... Field 1 matches with the regex pattern and provides results that have matching values. However, field 2 doesn't work as I am getting the results that do match the regex of field2 and not discarding them. According to the '!=', the values that match that particular regex shouldn't be present in the result of the query, but they are. So, it isn't working as it supposed to. I have tested the regex elsewhere and it is correct. Any ideas?

0 Karma
1 Solution

gvmorley
Contributor

Hi,

I think you may need to double-escape the backslash in your second regex. As a test, I tried this:

| makeresults
| eval field1="api.twitter.com"
| eval field2="ABC\xyz1aul4"
| regex field2!="(?i)abc\\\xyz[a-z0-9]{5}"

Which worked (i.e. it returned no results).

Likewise just invert the logic to see if it does match:

| regex field2="(?i)abc\\\xyz[a-z0-9]{5}"

See if that does it.

View solution in original post

gvmorley
Contributor

Hi,

I think you may need to double-escape the backslash in your second regex. As a test, I tried this:

| makeresults
| eval field1="api.twitter.com"
| eval field2="ABC\xyz1aul4"
| regex field2!="(?i)abc\\\xyz[a-z0-9]{5}"

Which worked (i.e. it returned no results).

Likewise just invert the logic to see if it does match:

| regex field2="(?i)abc\\\xyz[a-z0-9]{5}"

See if that does it.

raghav130593
Explorer

Yup. That worked. Thanks.

0 Karma

lquinn
Contributor

Can you post an example event please? One that should be filtered out by the second regex command but is not?

0 Karma

raghav130593
Explorer

I used stats in the query so I have a statistics table with selected fields. So, an example of the result which shouldn't be there would be
field1 field2
api.twitter.com ABC\xyz1aul4

This should ideally be avoided since it matches the second field's regex but it hasn't

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...