Splunk Search

What is the meaning of my regular expression?

Path Finder

Hi,

I used splunk to extract a new field and it has used this regular expression,

rex "^(?:[^\|\n]*\|){6}(?P<errorValue>.*)"

I have figured out that this checks for 6 occurrences of | and extracts the rest of the line.

What does ^(?:[^\|\n]* mean?

Also, what does .* at the end of (?P<errorValue>.*) mean?

Thanks in advance

0 Karma
1 Solution

Contributor

I believe the first part is looking for the first instance(^) in your string but it is a non-capture group so it looks for all of it but doesn't put it into your variable (Looks for the 6 occurences of the |, but doesn't save it) (?:[^|] \n is line-feed new line.

.* = Matches anything until the end of the string

View solution in original post

0 Karma

Contributor

I believe the first part is looking for the first instance(^) in your string but it is a non-capture group so it looks for all of it but doesn't put it into your variable (Looks for the 6 occurences of the |, but doesn't save it) (?:[^|] \n is line-feed new line.

.* = Matches anything until the end of the string

View solution in original post

0 Karma

Path Finder

Thanks Joshua and sundareshr.

Can you please tell me a few resources to learn regex?

0 Karma

Splunk Employee
Splunk Employee

Hi @namritha - If @JoshuaJohn or @sundareshr were helpful in answering your question, please don't forget to click on "Accept" below the best answer to resolve this post. Also, be sure to upvote any comments you found helpful too. Thanks! 🙂

0 Karma

Contributor

I feel regex is an example based language there isn't a ton to learn in terms of the actual language but have a quick reference sheet like on a site like regex101.com or regexr.com

Then just takes log files from your splunk queries and try to create regex searches on those sites to grab specific information you want to take

Super Champion

actually, from my own experience, if you learn Unix/Linux vi editor search and replace or sed command's search and replace, the regular expressions will become easy ( perl regular expressions as well )

grymoire is a good resource.. please check it..
http://www.grymoire.com/Unix/Sed.html

Legend

I pasted your regex here http://www.regex101.com and this is what I got back

^(?:[^\|\n]*\|){6}(?P<errorValue>.*)
^ represents start of the string 
(?:[^\|\n]*\|){6} Non-capturing group
Quantifier: {6} Exactly 6 times
[^\|\n]* match a single character not present in the list below
Quantifier: * Between zero and unlimited times, as many times as possible, giving back as needed [greedy]
\| matches the character | literally
\n matches a line-feed (newline) character (ASCII 10)
\| matches the character | literally

(?P<errorValue>.*) Named capturing group errorValue
.* matches any character (except newline)
Quantifier: * Between zero and unlimited times, as many times as possible, giving back as needed [greedy]
MATCH INFORMATION
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!