Reqular Expression 101

[rakeshksingh]

Hi All,

I am a new to Regular Expression topic, Could you please share me a link which help me to understand Regular Expression for splunk ?

[woodcock]

There are several different implementations of Regular Expression engines, all commonly called RegEx. Make sure that whatever you are reading/using is for Perl Compatible Regular Expressions, which is the flavor that Splunk uses.

[MuS]

Hi rakeshksingh,

Have a look at the docs here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/AboutSplunkregularexpressions and try the online regex tool called www.regex101.com which works perfect for Splunk regex. Another benefit of regex101.com is that it provides detailed explanation who and why it does match or does not match 😉

Hope this helps ...

cheers, MuS

[wrangler2x]

The regex101.com site that @MuS mentioned has checkboxes on the left to select what "flavor" of regular expression to use. As @woodcock pointed out, Splunk uses Perl Compatible Regular Expressions (PCRE). Just make sure the PCRE box is checked on regex101.com and you are good to go.

In Splunk, flags can be added to regular expressions by preceding them with (?flag). So, if you are looking to parse multi-line logs, you can add (?m) to the beginning. On the regex101.com site, you'll find a flag symbol to the right of the regular expression box. Click on that flag and it has checkboxes for any flag you want to have set for that regular expression.

Besides all the other sources mentioned my MuS and other commenters, there is also a tutorial here:

http://www.regular-expressions.info/tutorial.html

[cpetterborg]

Also watch Gabriel Vasseur's excellent presentation from last year's .conf:

http://conf.splunk.com/files/2016/recordings/become-a-regular-expressions-ninja-and-unlock-your-splu...

With the accompanying PDF of the presentation found here:

http://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-p...

He does a tutorial on using regular expressions. Very helpful.