Splunk Search

regex matched data only

mkarimi
Path Finder

I have a regex which looks for any event that has the repid=XXXX where XXXX is some number

"mysearch | rex repid=(?<REP_ID>\d+)"

I need to display data that only matches that criteria. for example none of these should be shown:

repid
or 
repid=
or 
repid%s20=
or
repid-1245
Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

View solution in original post

yannK
Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

mkarimi
Path Finder

got that to by using (?i) in regex _raw="(?i)repid=\d+"

0 Karma

mkarimi
Path Finder

awesome! thanks for the help. is it possible to make the repid in regex _raw="repid=\d+" case insensitive? the reason is that there might be some cases of RepID or repiD, etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...