Splunk Search

search regular expressions without field extraction

jeremiahc4
Builder

I would like to perform a regular expression search without any field extraction. I know you can do asterisks for things that start with what you're looking for, but all I have is a format of something I'm interested in. I'm sure this is simple and I've overlooked it, but I'm still coming up short. This is new unstructured data so I have no fields yet identified. I'm trying to search for a subset of events so I can start building out my field extractions.

I'm basically trying to search for any events that have a single letter followed by 6 numbers. I would use something like this in other languages;

[a-z,A-Z][0-9][0-9][0-9][0-9][0-9][0-9]
Tags (2)
0 Karma
1 Solution

cphair
Builder

cphair
Builder

Regex or rex would be what you want. Something like this should work:


... | regex _raw="\w\d{6}"

http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Rex
http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Regex

jeremiahc4
Builder

So the _raw was what I was missing I guess. Thanks.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...