Splunk Search

What special characters are available for use with rex and regex and what are their functions?

satya2p
Path Finder

I see a variety of letters being used like w,n,d,s etc. pls help me to understand what characters are available to use and what these characters stand for in these queries.

rex field=_raw=AnyKeyord "(?*w+)"
rex field=_raw=AnyKeyord "(?**n
+)"
regex AnyKeyord=
\d+*
regex AnyKeyord=\n+

Tags (2)
0 Karma
1 Solution

ppablo
Community Manager
Community Manager

Hi @satya2p

Have you taken a look at the Splunk documentation on regular expressions? It also covers the different character types:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/AboutSplunkregularexpressions

View solution in original post

dwaddle
SplunkTrust
SplunkTrust
man pcrepattern

rlough
Path Finder

Do you have a specific task you're trying to achieve?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Surely, me thought upon sitting to review the site of answers from Splunktonia, Surely this question would be answered? But nay, none dare tackle the daunting task of defining regex. But hark! A hero, in the distance! Although he be of simple stature, and average girth, he brought much knowledge and wisdom. He therefore sayeth: Yon @satya2p, hereupon receiving these words of written ideas, perhaps you should navigate towards the aforementioned site of destiny! http://www.regular-expressions.info/tutorial.html This "tutorial" gives many ideas and explanations that shall explain the nature of a regex and what "w", "n" and the like express! Enjoy thusly!

KindaWorking
Path Finder

Just to follow on from the witty alacercogitatus. Another tutorial I found very handy is:
http://regexone.com/

As for testing that your regex expression is correct, check out:
https://regex101.com/

The second link I gave you I still use to this day and will continue to use it no matter how proficient I get with regex.

ppablo
Community Manager
Community Manager

Hi @satya2p

Have you taken a look at the Splunk documentation on regular expressions? It also covers the different character types:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/AboutSplunkregularexpressions

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...