Splunk Search

Regular expression with lookup

stang1234
New Member

Blockquote

I have to build a table that lists all the service names that are in particular format for e.g "ABC-*.-<>", Is this possible??

I actually tried by building a regular expression like this index=my_index sourcetype=my_source | regex name = "^ABC-.*-(Name1|Name2|Name3|Name4|....Name600) but I am getting "Regex: regular expression too large error" Any other way of solving this??

Blockquote

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try something like this.

index=my_index sourcetype=my_source name = "ABC*" | rex field=name "^ABC-.*-(?<subname>.*)" | lookup names.csv name-field-in-lookup-file as subname | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try something like this.

index=my_index sourcetype=my_source name = "ABC*" | rex field=name "^ABC-.*-(?<subname>.*)" | lookup names.csv name-field-in-lookup-file as subname | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

stang1234
New Member

Fantastic, that worked!! This is exactly what I was looking for.

0 Karma

stang1234
New Member

All 600 start with a prefix like “ENV” and rest are random. I did create a lookup with these 600.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is there a pattern to the service name endings or are they 600 random strings?
Regex is better suited to validating data format than content. IOW, use rex to determine if a string is a potential service name and extract the "Name*" part. Then use a lookup to validate the Name against a list of known names.

---
If this reply helps you, Karma would be appreciated.
0 Karma

xpac
SplunkTrust
SplunkTrust

Can you please show some example data?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...