Splunk Search

Why is Regex not displaying results?

amitrinx
Explorer

Hi
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

Want to search all the ick using regex 
I tried 
regex ick="="([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})""

It is not giving any results.
Can some one help?

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @amitrinx,

could you share some complete log sample, without it it's difficoult to help you.

Anyway, the regex from @yuanliu seems to be correct and you could try to use it.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...