Splunk Search

regex matched data only

mkarimi
Path Finder

I have a regex which looks for any event that has the repid=XXXX where XXXX is some number

"mysearch | rex repid=(?<REP_ID>\d+)"

I need to display data that only matches that criteria. for example none of these should be shown:

repid
or 
repid=
or 
repid%s20=
or
repid-1245
Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

View solution in original post

yannK
Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

mkarimi
Path Finder

got that to by using (?i) in regex _raw="(?i)repid=\d+"

0 Karma

mkarimi
Path Finder

awesome! thanks for the help. is it possible to make the repid in regex _raw="repid=\d+" case insensitive? the reason is that there might be some cases of RepID or repiD, etc.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...