Splunk Search

Regex question

xvxt006
Contributor

Hi,

we have 2 uri patterns as shown below

/search?searchQuery=4gmw4 (the end part is always single word which is alpha numeric)
/search?searchQuery=Snatch+Blocks++%281%2F2+to+2+ton%29 (in this end part can have spaces, multiple words, etc).

for the first one i tried this and did not work.
| regex uri="(?=/search\?searchQuery=\w+$)"

2nd one no clue. Any suggestions would help.

Tags (1)
0 Karma

_d_
Splunk Employee
Splunk Employee

You can try using a regex that captures anything that follows the equal sign, that is not an equal sign.

| regex uri="(searchQuery=[^=]*$)"

amarsaroj
Explorer

adding to above answer:

If you want to capture the 2 uri patterns separately, then use

| regex uri="(searchQuery=[^+=]$)"
and
| regex uri="(searchQuery=[^=]+[^=]
$)"

assuming '+' does not appears in first uri type and is always present in 2nd uri type.

0 Karma

xvxt006
Contributor

i think when i add backslash it is somehow skipping that in the portal. So there is backslash next to w

0 Karma

xvxt006
Contributor

Actually the below expression did work out for me for the first uri pattern.
| regex (uri="searchQuery=\w{5}" i want to get only 2nd pattern but not the 1st one..

so i tried this but giving me syntax error. Can someone help with this?

regex (uri="searchQuery=\w+" AND regex (uri!="searchQuery=\w{5}")

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...