Splunk Search

Whats the best way to learn Regex commands?

anushareddy6767
Explorer

I'm learning splunk and I would like to write Regex commands. Can anyone suggest best way to master Regex commands.
Is there any manual apart from Search Manual to learn Regex commands?

Tags (2)
1 Solution

Richfez
SplunkTrust
SplunkTrust

I'd suggest something like this tutorial. If you don't like it, google "regex tutorial" and try a different one - there's quite a few to choose from.

Once you have a handle on them, you'll find regex101 is a fantastic resource to test things. You can search in Splunk Answers for regex, or follow the regex tag and use that to learn more.

I've also found I can use the GUI to create field extractions, then look at the regex it creates (there's a button to show regex). This isn't as helpful as it could potentially be for learning, because the GUI writes some pretty convoluted regex. In fact, in those cases I'd say I've learned more by seeing what the GUI wrote and making it simpler, more robust or adjusting it to certain needs.

View solution in original post

ppablo
Retired

Hi @anushareddy6767

Here is a previous Answers post with a bunch of online and offline regex resources to learn how to construct regular expressions for your data.
https://answers.splunk.com/answers/153171/is-there-any-online-regex-tool-to-create-regular-e.html

hylam
Contributor

Mastering Regular Expressions
http://shop.oreilly.com/product/9780596528126.do

Richfez
SplunkTrust
SplunkTrust

I'd suggest something like this tutorial. If you don't like it, google "regex tutorial" and try a different one - there's quite a few to choose from.

Once you have a handle on them, you'll find regex101 is a fantastic resource to test things. You can search in Splunk Answers for regex, or follow the regex tag and use that to learn more.

I've also found I can use the GUI to create field extractions, then look at the regex it creates (there's a button to show regex). This isn't as helpful as it could potentially be for learning, because the GUI writes some pretty convoluted regex. In fact, in those cases I'd say I've learned more by seeing what the GUI wrote and making it simpler, more robust or adjusting it to certain needs.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...