Splunk Search

Why is Regex not displaying results?

amitrinx
Explorer

Hi
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

Want to search all the ick using regex 
I tried 
regex ick="="([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})""

It is not giving any results.
Can some one help?

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @amitrinx,

could you share some complete log sample, without it it's difficoult to help you.

Anyway, the regex from @yuanliu seems to be correct and you could try to use it.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...