Splunk Search

What's the easiest way to Regex for any characters in the middle?

nessaner
Explorer

Hello, I need to take events with two kind of text (different paths) :

Appended to:  G:\Streamserve\
Appended to:  D:\G_volume\Streamserve\

As you can see the is part in the middle that should be different (I have only those 2 kind of cases). I tried with \S* as non whitespace characters but it's not working.  
sth like this
Appended to: \w?:\\(G_volume)*\\*Streamserve

What's is the easiest way to do it? 

Thanks fo the help

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You are almost there - try this

Appended to: +\w?:\\+(G_volume)*\\*Streamserve

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You are almost there - try this

Appended to: +\w?:\\+(G_volume)*\\*Streamserve

nessaner
Explorer

Thank you so much, it works!

Can I have one question tho? What "+" before  \w means? I know after something it means there is a match one or more times.
In this case Is it for whitespace? the /s+ would mean the same then?
Again, Thank you!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - from your examples there were multiple (2) spaces between the first colon and the drive letter

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...