Splunk Search

Using multiple REGEX in a single search

shrirangphadke
Path Finder

Hi,

I want to use multiple REGEX in OR condition in a single search. For Ex:

REGEX 1: "VDL2PortPropSet.* : Failure" OR 
REGEX 2: "Vpxa.*Copied"  OR 
REGEX 3: "opswitch.+ Failed to find netstack 'opswitch'"

How can I achieve this? Sorry if my question is repeated.
Please help.

Tags (2)
1 Solution

rkent
Explorer

You should be able to just put this in a single regex using the regex OR operator:

"VDL2PortPropSet.* : Failure|Vpxa.*Copied|opswitch.+ Failed to find netstack 'opswitch'"

I'll test this when I get to a system, but in the meantime give this a shot

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

For these simple examples you might even be fine without regex at all to speed up the search:

index=foo sourcetype=bar ("VDL2PortPropSet* : Failure" OR "Vpxa*Copied"  OR "opswitch* Failed to find netstack 'opswitch'") | rest of the search pipeline
0 Karma

shrirangphadke
Path Finder

Okey, that kind of search didn't work for me! Strange

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wildcard searches have been part of Splunk since forever.

0 Karma

shrirangphadke
Path Finder

Hi martin_mueller,

Thanks for your answer. This kind of search did not work for me. Is it supported from Splunk version 6.2.1? I am using 6.1.8

0 Karma

rkent
Explorer

You should be able to just put this in a single regex using the regex OR operator:

"VDL2PortPropSet.* : Failure|Vpxa.*Copied|opswitch.+ Failed to find netstack 'opswitch'"

I'll test this when I get to a system, but in the meantime give this a shot

shrirangphadke
Path Finder

It worked ! Thank you very much

0 Karma

rkent
Explorer

You're absolutely welcome

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...