×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
mikeclemson
New Member
Member since: ‎10-24-2019
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-24-2019
View All

Re: Help needed capturing a regex and then groupin...

by in Splunk Enterprise Security
‎10-25-2019 06:32 AM
‎10-25-2019 06:32 AM
Thanks! I misunderstood the examples as thinking I needed the name, in your example extension_id, to exist in my actual data. I realize now I just make up whatever I want, making sure the entire thing is inside a capture group with parentheses. ... View more

Help needed capturing a regex and then grouping on...

by in Splunk Enterprise Security
‎10-24-2019 03:13 PM
‎10-24-2019 03:13 PM
I have unstructured data that can vary, and I want to find results that match exactly 32 lowercase a-z characters, and then group based on that match. My field name is cs6, which includes an entire HTTP request. I see that my regex is quite simple, regex cs6="[a-z]{32}". How do I further extract this value and group on the occurrences to find out which of these is most common? These represent Chrome extension IDs. The examples that I found seemed to require me to have a consistent prefix, which I won't have. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM