Splunk Search

regex remove events from search

brdr
Contributor

I'm reading in events from a lookup table and I'm trying to remove events using RegEx that meet criteria but can't get it to work. I want to remove any host that is an IP address.

lookup file:
host
x.x.x.x
hosta
x.x.x.x
hostb

| inputlookup mylookup

| regex host!="/^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$/"
| table host

With this I still get all events. thx.

Tags (3)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

Try this:

| inputlookup mylookup 
| regex host!="^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"
| table host

You just had to remove the / at the start and end 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

View solution in original post

TISKAR
Builder

Hello,

You can also use the regex OR match function:

match:

   , | inputlookup mylookup 
     | where !match(host,"(\d{1,3}\.){3}\d+")
     | table host

Regex:

 | inputlookup mylookup 
 | regex host!="^(\d{1,3}\.){3}\d{1,3}$"
 | table host

brdr
Contributor

Thanks TISKAR, xpac for response!

0 Karma

xpac
SplunkTrust
SplunkTrust

Try this:

| inputlookup mylookup 
| regex host!="^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"
| table host

You just had to remove the / at the start and end 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!