Splunk Search

search regular expressions without field extraction

jeremiahc4
Builder

I would like to perform a regular expression search without any field extraction. I know you can do asterisks for things that start with what you're looking for, but all I have is a format of something I'm interested in. I'm sure this is simple and I've overlooked it, but I'm still coming up short. This is new unstructured data so I have no fields yet identified. I'm trying to search for a subset of events so I can start building out my field extractions.

I'm basically trying to search for any events that have a single letter followed by 6 numbers. I would use something like this in other languages;

[a-z,A-Z][0-9][0-9][0-9][0-9][0-9][0-9]
Tags (2)
0 Karma
1 Solution

cphair
Builder

cphair
Builder

Regex or rex would be what you want. Something like this should work:


... | regex _raw="\w\d{6}"

http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Rex
http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Regex

jeremiahc4
Builder

So the _raw was what I was missing I guess. Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...