Splunk Search

Regex "(?<!\d)"

boris
Path Finder

What does the regex in my question's title above mean?

Source: Search Language Quick Reference Card (on top of page 3)

Context: "(?<!\d)" is part of this full example:

| regex _raw="(?<!\d)10.\ d{1,3}\.\d{1,3}\.\d{1,3} (?!\d)"

for finding this type of string:

10.0.0.0/8

I understand this part:

10.\ d{1,3}\.\d{1,3}\.\d{1,3}

10.0.0.0

I am also uncertain about this end part:

(?!\d)
Tags (1)
0 Karma
1 Solution

boris
Path Finder
(?<!a)b

matches a "b" that is not preceded by an "a"

Example:

(?<!\d)f 

would find the letter f as long as it wasn't like 5f.

(?<=a)b 

is the opposite. A positive look behind.

View solution in original post

0 Karma

boris
Path Finder
(?<!a)b

matches a "b" that is not preceded by an "a"

Example:

(?<!\d)f 

would find the letter f as long as it wasn't like 5f.

(?<=a)b 

is the opposite. A positive look behind.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...