Splunk Search
Highlighted

What sort of regular expressions does splunk use?

Builder

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

Tags (1)
Highlighted

Re: What sort of regular expressions does splunk use?

Motivator
Highlighted

Re: What sort of regular expressions does splunk use?

Splunk Employee
Splunk Employee

also useful: http://www.pcre.org/

0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

Builder

Great, thank you!

0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

Splunk Employee
Splunk Employee

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

SplunkTrust
SplunkTrust

That link does not work are you referring to "About Splunk Regular Expressions" ?

0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

Legend

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

Splunk Employee
Splunk Employee

Yes, I pasted the wrong one, and have fixed it. Thanks

0 Karma
Highlighted

Re: What sort of regular expressions does splunk use?

Legend

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions




| eval message="Happy Splunking!!!"