Splunk Search

Simplify REGEX

CarbonCriterium
Path Finder

Several months back I created a macro with the following regular expressions to "clean up" and concatenate several strings that I  often use.  Is there a website or tool that would help me to understand regex so that I may figure out how to simplify the search string? 

My goal is to speed up the search.  I think eliminating the redundant rex commands would help but if there is an even better solution I want to know what it is.

The macro currently contains the following:

 

| eval source_clean=source 
| rex field=source_clean mode=sed "s/\\\u_\S+//g" 
| rex field=source_clean mode=sed "s/^[^\\\]*\\\//" 
| rex field=source_clean mode=sed "s/^[^\\\]*\\\//" 
| rex field=source_clean mode=sed "s/^[^\\\]*\\\//" 
| lookup Source-Lookup.csv source AS source_clean OUTPUT web_domain 
| eval pages = web_domain+cs_uri_stem​​​​​​​

 

 
I do not have access to the lookup table that would allow me to add slashes to the `source column` as a way to eliminate the need for lines 3-5.  

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @CarbonCriterium,

regex101.com is very useful to understand a regex, but to simplify your regex you have to work by yourself or sharing samples.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @CarbonCriterium,

regex101.com is very useful to understand a regex, but to simplify your regex you have to work by yourself or sharing samples.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...