Splunk Search

search using a regex

alexl1
Path Finder

hi, if I want to find events using a regex what is the syntax?

e.g if I want all events with either big or bag is there a way to use a regex like b.g

thanks,

Tags (1)
0 Karma
1 Solution

alexl1
Path Finder

I found it

regex _raw="b.g"

View solution in original post

0 Karma

grijhwani
Motivator

Actually, to find answer specific example the regex would in fact be "b[ai]g". Your example would find any combination of three printable characters starting with "b" and ending with "g", and would also return such things as "b-g", "bog", "b4g", etc...

Furthermore, your example would match anything containing words with a similar sequence, such as "begin", "bogus", "abigail", etc...

If you want to limit to complete words only you will need the start/end of word markers (< and >), which in the context of the config file may also require escaping with "\", as in this example:

regex _raw="\<b[ai]g\>"
0 Karma

alexl1
Path Finder

I found it

regex _raw="b.g"

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...