Splunk Search

Why is Regex not displaying results?

amitrinx
Explorer

Hi
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

Want to search all the ick using regex 
I tried 
regex ick="="([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})""

It is not giving any results.
Can some one help?

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @amitrinx,

could you share some complete log sample, without it it's difficoult to help you.

Anyway, the regex from @yuanliu seems to be correct and you could try to use it.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...