Hello All, I am not so familiar with regex, but looking at some old query have been able to build one for my need. I am looking for help to understand how this is working in terms of r...
hey all looking for some help pulling some digits via regex. I am looking to pull the numbers directly after Actual value(in the example event below 48). I would like to exclude the quotes and c...
Hi, I have the below event where i tried to extract field ServerA Event: ADMU0509I: The Application Server " serverA " cannot be reached. It appears to be stopped. Que...
HI All, I have this JSON file that is 4400 Long , and i want it to reroute to a specific Indexer. If i use REGEX101 - the regex will work, but when applied to Splunk - It does not reroute t...
Can someone explain me wht that simple regex means??
Sorry for this simple question but this is very new to me. I understand these..
^ --> refers to start of / position
+--> means one o...
Trying to Pick domainType and domainName from below log using the below regex: It works in regex101 but not in Splunk, it gives a blank column. domainName - rex"(?:domainName\\\"\:\\\")(?<d...
Hey All, I am trying to pull the username from the following event which is everything after the Rightnetworks\ in the event. Also to complicate things It could be a name or a set of numbers or a na...
Which of the following (in terms of the REGEX) is the most efficient? I've seen examples of all of them. And is there an even more efficient REGEX?
[send_to_nullQueue_dot]
SOURCE_KEY = _...
Here is the regex to extract message_type based on CIM. Could anyone make this faster than 1387 steps? https://regex101.com/r/dHbs4i/1 (?P<message_type>[^.]query|response)\: &n...
Hello, I need a regex to extract the GUID from non-standard UPN results that show up in this format: ex095838d@mydomain.onmicrosoft.com First 2 characters: Will always be "ex". GUID: Is the n...