Splunk Search

Why is Regex not displaying results?

amitrinx
Explorer

Hi
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

Want to search all the ick using regex 
I tried 
regex ick="="([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})""

It is not giving any results.
Can some one help?

Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @amitrinx,

could you share some complete log sample, without it it's difficoult to help you.

Anyway, the regex from @yuanliu seems to be correct and you could try to use it.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

if, by

I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af 

you mean that whole string is part of a raw event, you need

| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"

to pick it out.

If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...