Splunk Search

Regex matching in search when it doesn't in regex creator

beaunewcomb
Communicator

This regex is actually a lot longer, and obviously the events are too, but here's what appears to be happening. I want data out of paranthesis in the format below, EXCEPT for when the word in front of the paren is "trans" like below. So I'm using ^ to specify what I don't want to match. It appears to work fine in the regex builder, but when I search for object=* I'm getting the objects after trans as well.

I wrote in additional regex to try to filter anything with just numbers, but that shows the same behavior. Is it something with ^ ?

mq-qm(QMNGRBKUP_01)

trans(30251343)

[^trans][\w'-]+((?P[^0-9][\w'-]+)

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Brackets in regexes denote a range of characters, and the ^ character within brackets negate the match. So [^trans] does NOT perform a negated match on the string "trans", rather it matches one of the characters t, r, a, n and s. To do that kind of match you need a negative lookbehind (http://www.regular-expressions.info/lookaround.html ).

(?<!trans)[\w'-]+\((?P<object>[^0-9][\w'-]+)

I still think it shouldn't be matching anyway though, because [^trans] will match on the last s in the word...

View solution in original post

Ayn
Legend

Brackets in regexes denote a range of characters, and the ^ character within brackets negate the match. So [^trans] does NOT perform a negated match on the string "trans", rather it matches one of the characters t, r, a, n and s. To do that kind of match you need a negative lookbehind (http://www.regular-expressions.info/lookaround.html ).

(?<!trans)[\w'-]+\((?P<object>[^0-9][\w'-]+)

I still think it shouldn't be matching anyway though, because [^trans] will match on the last s in the word...

beaunewcomb
Communicator

Thank you for the insight. you're right on both accounts... where I messed up was I had a different extraction for trans which was setting as well.

So now I also know how to use multiple regexes for one field 😛

Thanks again for your expertise

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...