Regex help

[jboustead]

I am currently trying to use a regex to pick out the events with the date '2020XXXX' - I want the regex to search pick up any event date providing it does not have 'reg' following the '.' or '_' (pick out all the event dates below, except the first). How do I do this? 

Current regex: 2020\d{4}[\.\_]

List of different events\logs from the splunk search:

_20201007144100_20200416_reg.zip

_20201007103200_20201007.zip

_20201007095000_20201007.zip

_20201007092933_20201007.zip

_20201007061717_20201007_txn.zip

_20201007041719_20201007.zip

[FritzWittwer]

^_2\d*_(2)(\d*)([_\.])(?!req).*zip$

Works for all dates before year 3000

[jboustead]

Thank you for your quick response. Is it possible to expand that regex so that it picks up string without 'reg' following the '_' or '.'?

For example: 

So it would pick up:

_20201007103200_20201007.zip

but would not pick up:

_20201007144100_20200416_reg.zip

[gcusello]

Hi @jboustead,

let me understand: do you want "_20201007103200_20201007.zip" and you want to exclude "_20201007144100_20200416_reg.zip", is it correct?

If this is your need, try this:

your_search
| regex "_2020\d{4}\.zip"
| ...

that you can test at https://regex101.com/r/g82uft/2

Ciao.

Giuseppe

[jboustead]

That is correct, however - I am also wanting to include other strings such as: 

_20201007061717_20201007_txn.zip

_20201007092933_20201007_stl.zip

Basically to include any string that does not contain _reg after the date...

[gcusello]

Hi @jboustead,

please try (like the one hinted by @FritzWittwer) someting like this:

your_search
| regex "_2020\d{4}([^\.]*)(?|reg)\.zip"
| ...

Ciao.

Giuseppe

[gcusello]

Hi @jboustead,

try this regex

your_search
| regex "_2020\d{4}_|\."
| ...

that you can test at https://regex101.com/r/g82uft/1

Ciao.

Giuseppe