Splunk Search

Regular expression with lookup

stang1234
New Member

Blockquote

I have to build a table that lists all the service names that are in particular format for e.g "ABC-*.-<>", Is this possible??

I actually tried by building a regular expression like this index=my_index sourcetype=my_source | regex name = "^ABC-.*-(Name1|Name2|Name3|Name4|....Name600) but I am getting "Regex: regular expression too large error" Any other way of solving this??

Blockquote

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try something like this.

index=my_index sourcetype=my_source name = "ABC*" | rex field=name "^ABC-.*-(?<subname>.*)" | lookup names.csv name-field-in-lookup-file as subname | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try something like this.

index=my_index sourcetype=my_source name = "ABC*" | rex field=name "^ABC-.*-(?<subname>.*)" | lookup names.csv name-field-in-lookup-file as subname | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

stang1234
New Member

Fantastic, that worked!! This is exactly what I was looking for.

0 Karma

stang1234
New Member

All 600 start with a prefix like “ENV” and rest are random. I did create a lookup with these 600.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is there a pattern to the service name endings or are they 600 random strings?
Regex is better suited to validating data format than content. IOW, use rex to determine if a string is a potential service name and extract the "Name*" part. Then use a lookup to validate the Name against a list of known names.

---
If this reply helps you, Karma would be appreciated.
0 Karma

xpac
SplunkTrust
SplunkTrust

Can you please show some example data?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...