Splunk Search

What sort of regular expressions does splunk use?

Builder

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

Tags (1)
1 Solution

Motivator

SplunkTrust
SplunkTrust

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Splunk Employee
Splunk Employee

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

0 Karma

SplunkTrust
SplunkTrust

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Splunk Employee
Splunk Employee

Yes, I pasted the wrong one, and have fixed it. Thanks

0 Karma

SplunkTrust
SplunkTrust

That link does not work are you referring to "About Splunk Regular Expressions" ?

0 Karma

Motivator

Builder

Great, thank you!

0 Karma

Splunk Employee
Splunk Employee

also useful: http://www.pcre.org/

0 Karma