good regex (fast)

[mcbradford]

I have a field called "user". I am looking for matches that contain 6 or 7 characters, and always end with "a" but does not end in "pa".

I am using the following and it works, but I was wondering if someone might have a better regex expression that would be faster?

regex user=".+[^p]a$"

[tpflicke]

Just a hint how to quickly test some regular expressions without having the data in splunk using eval - the examples below show tests against the regex given by jgreenleaf

index=* | head 1 | eval user="12345pa" | regex user="^.{5,6}(?<!p)a$" | table user

index=* | head 1 | eval user="123456a" | regex user="^.{5,6}(?<!p)a$" | table user

[jgreenleaf]

^.{5,6}(?<!p)a$

should do what you want

[mcbradford]

This worked, but it is about as fast as my originally regex.

[jtrucks]

Technically, your regex will match any length string that starts with at least one character followed by the letter 'a' (as end of string) without a letter 'p' coming before that letter 'a'. This means that it would match user="1a" or user="mydata" or user="my other data here a" so if you need to restrict to only a full string length of 6 or 7 characters, you are really looking for regex that looks for "5 or 6 of any character, followed by a letter 'a' to end the string, as long as there is not a letter 'p' immediately before the last letter 'a'" right?

Perhaps this will work:

^.{5,6}(a|[^p]a)$

[jtrucks]

Hmm. odd. I edited the entry to show string termination at the end. I don't have data in splunk to test this exact string, so it might need some tweaking. The above IS pure PCRE syntax, however. If you don't care the length of the string, your regex is perfectly fine and fast enough…

[mcbradford]

This found besmanager???

[somesoni2]

I don't have data to test it but this is also an options.

| where LIKE(user,"%a") AND NOT LIKE(user,"%pa")