Splunk Search

Regex field != expression not matching

raghav130593
Explorer

I have a query where I am performing regex matching on two different fields, field1 and field2. index=proxylogs uri!=aa.*|regex field1=".*abc\..*|.*api\..*"|regex field2!="(?i)abc\\xyz[a-z0-9]{5}|(?i)abc\\kkr[a-z0-9]{6}"|.... Field 1 matches with the regex pattern and provides results that have matching values. However, field 2 doesn't work as I am getting the results that do match the regex of field2 and not discarding them. According to the '!=', the values that match that particular regex shouldn't be present in the result of the query, but they are. So, it isn't working as it supposed to. I have tested the regex elsewhere and it is correct. Any ideas?

0 Karma
1 Solution

gvmorley
Contributor

Hi,

I think you may need to double-escape the backslash in your second regex. As a test, I tried this:

| makeresults
| eval field1="api.twitter.com"
| eval field2="ABC\xyz1aul4"
| regex field2!="(?i)abc\\\xyz[a-z0-9]{5}"

Which worked (i.e. it returned no results).

Likewise just invert the logic to see if it does match:

| regex field2="(?i)abc\\\xyz[a-z0-9]{5}"

See if that does it.

View solution in original post

gvmorley
Contributor

Hi,

I think you may need to double-escape the backslash in your second regex. As a test, I tried this:

| makeresults
| eval field1="api.twitter.com"
| eval field2="ABC\xyz1aul4"
| regex field2!="(?i)abc\\\xyz[a-z0-9]{5}"

Which worked (i.e. it returned no results).

Likewise just invert the logic to see if it does match:

| regex field2="(?i)abc\\\xyz[a-z0-9]{5}"

See if that does it.

raghav130593
Explorer

Yup. That worked. Thanks.

0 Karma

lquinn
Contributor

Can you post an example event please? One that should be filtered out by the second regex command but is not?

0 Karma

raghav130593
Explorer

I used stats in the query so I have a statistics table with selected fields. So, an example of the result which shouldn't be there would be
field1 field2
api.twitter.com ABC\xyz1aul4

This should ideally be avoided since it matches the second field's regex but it hasn't

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...