Splunk Search

Reqular Expression 101

rakeshksingh
New Member

Hi All,

I am a new to Regular Expression topic, Could you please share me a link which help me to understand Regular Expression for splunk ?

0 Karma

woodcock
Esteemed Legend

There are several different implementations of Regular Expression engines, all commonly called RegEx. Make sure that whatever you are reading/using is for Perl Compatible Regular Expressions, which is the flavor that Splunk uses.

0 Karma

MuS
Legend

Hi rakeshksingh,

Have a look at the docs here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/AboutSplunkregularexpressions and try the online regex tool called www.regex101.com which works perfect for Splunk regex. Another benefit of regex101.com is that it provides detailed explanation who and why it does match or does not match 😉

Hope this helps ...

cheers, MuS

wrangler2x
Motivator

The regex101.com site that @MuS mentioned has checkboxes on the left to select what "flavor" of regular expression to use. As @woodcock pointed out, Splunk uses Perl Compatible Regular Expressions (PCRE). Just make sure the PCRE box is checked on regex101.com and you are good to go.

In Splunk, flags can be added to regular expressions by preceding them with (?flag). So, if you are looking to parse multi-line logs, you can add (?m) to the beginning. On the regex101.com site, you'll find a flag symbol to the right of the regular expression box. Click on that flag and it has checkboxes for any flag you want to have set for that regular expression.

Besides all the other sources mentioned my MuS and other commenters, there is also a tutorial here:

http://www.regular-expressions.info/tutorial.html

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Also watch Gabriel Vasseur's excellent presentation from last year's .conf:

http://conf.splunk.com/files/2016/recordings/become-a-regular-expressions-ninja-and-unlock-your-splu...

With the accompanying PDF of the presentation found here:

http://conf.splunk.com/files/2016/slides/become-a-regular-expressions-ninja-and-unlock-your-splunk-p...

He does a tutorial on using regular expressions. Very helpful.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...