Regex to start with specific characters

[xvxt006]

Hi, i would like to get all the requests that start with / and there will be few alpha numeric characters and then ends with .css or .js, etc.

i have tried ^/*.(css|js) but did not work. Any suggestions?

Sample requests

/B387_38.css
/Globalfile.js

[kristian_kolb · Accepted solution]

Well, you probably should not start the regex with a caret (^), unless you want to start your matching from the very beginning of the event. Also, there seems to be some confusion regarding regex wildcard characters.

* = match the preceding character zero or more times
. = match any character (once)

"slash, followed by a few alphanums, followed by dot, followed by either css or js" would look like;

/[A-Za-z0-9]+\.(js|css)

if you also want underscore to match in the filename, you can actually shorten the expression

/\w+\.(js|css)

Note, if you want to use the regex search command, you might need to specify more things, like a field to operate on, or quoting.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Regex

[kristian_kolb]

yep, if you use a field to operate on, the caret is relative to the field value.

[Ayn]

Add the initial caret.

[xvxt006]

Thank you Kristian. the pattern i gave is uri and it always starts with / so that is why i had ^. So if i wanted to start with should i just add ^ at the beginning for the regex expression.

When i use the regex you have given, i am getting

/mobile/m/shared/css/global.css
/js/grainger/addtocartajax.js

which is not the format i am looking for (/B387_38.css or
/Globalfile.js). Do you know what to change?

[kristian_kolb]

OOPS. A typo in the regexs. Fixed that now.