Splunk Search

What sort of regular expressions does splunk use?

msarro
Builder

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

Tags (1)
1 Solution

ftk
Motivator

niketn
Legend

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

scorrie_splunk
Splunk Employee
Splunk Employee

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

0 Karma

niketn
Legend

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

scorrie_splunk
Splunk Employee
Splunk Employee

Yes, I pasted the wrong one, and have fixed it. Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

ftk
Motivator

msarro
Builder

Great, thank you!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

also useful: http://www.pcre.org/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...