Splunk Search

regex remove events from search

brdr
Contributor

I'm reading in events from a lookup table and I'm trying to remove events using RegEx that meet criteria but can't get it to work. I want to remove any host that is an IP address.

lookup file:
host
x.x.x.x
hosta
x.x.x.x
hostb

| inputlookup mylookup

| regex host!="/^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$/"
| table host

With this I still get all events. thx.

Tags (3)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

Try this:

| inputlookup mylookup 
| regex host!="^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"
| table host

You just had to remove the / at the start and end 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

View solution in original post

TISKAR
Builder

Hello,

You can also use the regex OR match function:

match:

   , | inputlookup mylookup 
     | where !match(host,"(\d{1,3}\.){3}\d+")
     | table host

Regex:

 | inputlookup mylookup 
 | regex host!="^(\d{1,3}\.){3}\d{1,3}$"
 | table host

brdr
Contributor

Thanks TISKAR, xpac for response!

0 Karma

xpac
SplunkTrust
SplunkTrust

Try this:

| inputlookup mylookup 
| regex host!="^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}$"
| table host

You just had to remove the / at the start and end 🙂

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...