Splunk Search

regex syntax clarification

drapkin11
Explorer

The following search returns results:
"context"

But this one does not:
regex "context"

And neither does this:
regex _raw="context"

+Why not?+

I am using Splunk 4.3.3 and according to http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Regex the previous 2 are valid and should return results.

I know that the word "context" is mentioned in my "_raw" field many times because I've exported a number of log events and found it there.

Tags (1)
0 Karma
1 Solution

jtacy
Builder

I believe the regex command needs to be part of a pipeline, otherwise the search is actually going to be for the exact term that you specify. So, this probably wouldn't work:

regex "context"

...but this should:

| regex "context"

Please let us know if this works, thanks!

View solution in original post

0 Karma

jtacy
Builder

I believe the regex command needs to be part of a pipeline, otherwise the search is actually going to be for the exact term that you specify. So, this probably wouldn't work:

regex "context"

...but this should:

| regex "context"

Please let us know if this works, thanks!

0 Karma

jtacy
Builder

Interesting! I didn't get that error but I tested on 5.0.2. Thanks for posting what worked for you!

0 Karma

drapkin11
Explorer

This didn't work: | regex "context"
Neither did this: * | regex "context"
In both cases I got this error: Error in 'SearchOperator:regex': Usage: regex (=|!=) )

But your answer led me to this which worked: * | regex _raw="context"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...