Splunk Search

Simple Regex in search

balcv
Contributor

I have a string of data that includes a field named user that has a value made up of domain\userid (eg prod\3245762 or tst\3245762 tst\smith) . I am wanting to write a search that can pull data based on a wildcard for the domain then only detect userid starting with 3,4 or 5).
I've tried index=* | rex field=user("*\\[3-5]*")
and various versions of. The majority return errors such as "...... is invalid", "Error in Search Operator:regex"

Can anyone shed some light on an appropriately formatted regex or rex statement please.

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Hi @balcv

Try this

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | regex user="(.*)\\\([3-5][0-9]*$)"

View solution in original post

paranjith
Explorer

Try this:

index=* | rex field=user "(?P<domain>^.*)\\(?P<userid>[3-5].*$)"

This regex retrieves only the domain\userid where userid starts with either 3, 4 or 5 and any value for domain.

Hope this helps!!!

vinod94
Contributor

Hi @balcv ,

Do you want something like this ....

Your search |  rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

this is a run anywhere search

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | fields - _time 
| rex field=user "(?P<domain>.*)\\\\(?P<userid>.*)" 
| rex field=userid "(?P<userid_startingwith_3or5>3.+|5.+)"

vnravikumar
Champion

Hi @balcv

Try this

| makeresults 
| eval user="prod\3245762;tst\3245762;tst\smith" 
| makemv delim=";" user 
| mvexpand user  | regex user="(.*)\\\([3-5][0-9]*$)"

vnravikumar
Champion

@balcv, resolved?

0 Karma

balcv
Contributor

Thanks for your help. All good now.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try this: index=* | rex "\\(?<username>[3-5]\w+)"

All the best

balcv
Contributor

Still giving me the following error:

Error in 'rex' command: Encountered the following error while compiling the regex '*\(?<username>[3-5]\w+)': Regex: quantifier does not follow a repeatable item

What I though I was needing would be \ for the domain wildcard, then anything **starting* with 3,4 or 5 which could contain up to 7 or 8 characters. (eg tst\326541 or prod\456987)

So something along the lines of rex field=user "*\\([3-5]*")

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try my latest one that I edited in: index=* | rex "\\(?<username>[3-5]\w+)"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You can also try something more restrictive like this: index=* | rex "(?:prod|tst)\\(?<username>[3-5]\w+)"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...