What sort of regular expressions does splunk use?

[msarro]

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

[niketn]

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions

[scorrie_splunk]

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

[niketn]

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions

[scorrie_splunk]

Yes, I pasted the wrong one, and have fixed it. Thanks

[gjanders]

That link does not work are you referring to "About Splunk Regular Expressions" ?

[ftk · Accepted solution]

PCRE

[msarro]

Great, thank you!

[gkanapathy]

also useful: http://www.pcre.org/