Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Regex not working as expected
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regex not working as expected
For one of the Security usecase, we need to extract Group Memberships from the Domain. The trickier part is some of the Group Memberships doesnt have domain name in front of it.
I am attaching the Regex link which is working fine on Regex101-
https://regex101.com/r/X2YAAd/1
but for some strange reasons, when i use the same regex on Splunk its not working.
This is to extract Group membership on EventCode=4627
Could anyone help me here..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you elaborate what you mean by "same regex is not working on Splunk"?
One problem may be that you are not using any names for the groups, so Splunk does not know what to name the field.
Also, if you need multiple matches, try using the max_match option.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Always set the RegEx engine to Python. Also try to set (?ms) in front, that should do.
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh.. i have always used PCRE. When I have changed to python its blank.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The https://regex101.com/r/X2YAAd/1 of your original post works for me when adding (?ms) at the beginning and using Python. Did you try that in Splunk?
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello I have tried with the capturing group and still no luck
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26
Make Your Machine Data AI-Ready in Splunk
Splunk Asynchronous Forwarding Explained
