Splunk Search

good regex (fast)

mcbradford
Contributor

I have a field called "user". I am looking for matches that contain 6 or 7 characters, and always end with "a" but does not end in "pa".

I am using the following and it works, but I was wondering if someone might have a better regex expression that would be faster?

regex user=".+[^p]a$"

Tags (1)
0 Karma

tpflicke
Path Finder

Just a hint how to quickly test some regular expressions without having the data in splunk using eval - the examples below show tests against the regex given by jgreenleaf

index=* | head 1 | eval user="12345pa" | regex user="^.{5,6}(?<!p)a$" | table user

index=* | head 1 | eval user="123456a" | regex user="^.{5,6}(?<!p)a$" | table user
0 Karma

jgreenleaf
Explorer
^.{5,6}(?<!p)a$

should do what you want

mcbradford
Contributor

This worked, but it is about as fast as my originally regex.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Technically, your regex will match any length string that starts with at least one character followed by the letter 'a' (as end of string) without a letter 'p' coming before that letter 'a'. This means that it would match user="1a" or user="mydata" or user="my other data here a" so if you need to restrict to only a full string length of 6 or 7 characters, you are really looking for regex that looks for "5 or 6 of any character, followed by a letter 'a' to end the string, as long as there is not a letter 'p' immediately before the last letter 'a'" right?

Perhaps this will work:

^.{5,6}(a|[^p]a)$
--
Jesse Trucks
Minister of Magic

jtrucks
Splunk Employee
Splunk Employee

Hmm. odd. I edited the entry to show string termination at the end. I don't have data in splunk to test this exact string, so it might need some tweaking. The above IS pure PCRE syntax, however. If you don't care the length of the string, your regex is perfectly fine and fast enough…

--
Jesse Trucks
Minister of Magic
0 Karma

mcbradford
Contributor

This found besmanager???

0 Karma

somesoni2
Revered Legend

I don't have data to test it but this is also an options.

| where LIKE(user,"%a") AND NOT LIKE(user,"%pa")

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...