Whats the best way to learn Regex commands?

[anushareddy6767]

I'm learning splunk and I would like to write Regex commands. Can anyone suggest best way to master Regex commands.
Is there any manual apart from Search Manual to learn Regex commands?

[ppablo]

Hi @anushareddy6767

Here is a previous Answers post with a bunch of online and offline regex resources to learn how to construct regular expressions for your data.
https://answers.splunk.com/answers/153171/is-there-any-online-regex-tool-to-create-regular-e.html

[hylam]

Mastering Regular Expressions
http://shop.oreilly.com/product/9780596528126.do

[Richfez · Accepted solution]

I'd suggest something like this tutorial. If you don't like it, google "regex tutorial" and try a different one - there's quite a few to choose from.

Once you have a handle on them, you'll find regex101 is a fantastic resource to test things. You can search in Splunk Answers for regex, or follow the regex tag and use that to learn more.

I've also found I can use the GUI to create field extractions, then look at the regex it creates (there's a button to show regex). This isn't as helpful as it could potentially be for learning, because the GUI writes some pretty convoluted regex. In fact, in those cases I'd say I've learned more by seeing what the GUI wrote and making it simpler, more robust or adjusting it to certain needs.