Regex help - sourcetypes with hyphens, -too_small, & -\d+

[Runals]

Relative to sourcetypes I'm trying to come up with a regex to pull out the 'root' being sensitive to the naming convention for ones that Splunk has attempted to learn (-too_small & -#). What is tripping me up is when a sourcetype has a hyphen in it already. This regex gets me pretty close but if anyone can recommend a tweak I'd be all ears.

| rex field=sourcetype "(?<st>[^-]+)(?<d>-too_small$|-\d+$)?" 

So for example if my sourcetype is 'my-sourcetype' the regex above will return 'my'

[martin_mueller · Accepted solution]

Use this instead:

| rex field=sourcetype "^(?<st>.+?)(?<d>-too_small|-\d+)?$"

I made these changes:

• Allow hyphens in <st>
• Make <st> non-greedy to avoid eating up <d>
• Move the $ anchor out of the optional <d> to force the non-greedy <st> to go all the way
• Added a ^ anchor - for prettiness/readability, no functional need because <st> will start at the beginning anyway