Splunk Search

Splunk Regex Question

NeonFlash
Explorer

I want to list all the file names in a log file in Splunk whose name ends with, "_bn.txt"

Let's say the field name is path

so my regex looks like

regex path=".*_bn.txt$"

However, this does not list down the results.

But if I use the following regex:

regex path=".*.txt$"

I am able to see all the filenames which end in .txt.

Need to find all the file names ending in, _bn.txt

Thanks.

PS: I don't think underscore is a metacharacter which needs to be escaped.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Underscore is not a metacharacter, but the period is.

regex path=".*_bn\.txt$"

would be more accurate. But if there were files that ended in _bn.txt, the first regular expression still should have matched them...

So are you sure that there are any file names ending in _bn.txt in the time range that you are searching?

View solution in original post

lguinn2
Legend

Underscore is not a metacharacter, but the period is.

regex path=".*_bn\.txt$"

would be more accurate. But if there were files that ended in _bn.txt, the first regular expression still should have matched them...

So are you sure that there are any file names ending in _bn.txt in the time range that you are searching?

View solution in original post

NeonFlash
Explorer

Hi, yes, the regex worked. For some reason when I ran the splunk query for the first time, it did not work. Yes, I escaped the metacharacter with a backslash. @Ayn: In my case the field name is different 🙂

0 Karma

Ayn
Legend

Also, where are you getting the field name path from? If you're talking about Splunk's field for showing the path of input files, that field's name is source.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!