0% found this document useful (0 votes)

98 views3 pages

Splunk 8.2.3 SearchReference Regex

Uploaded by

yash Mehra

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

98 views3 pages

Splunk 8.2.3 SearchReference Regex

Uploaded by

yash Mehra

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 3

Splunk® Enterprise

Search Reference 8.2.3

regex
Generated: 11/01/2021 6:26 am

Copyright (c) 2021 Splunk Inc. All Rights Reserved

regex
Description

Removes results that match or do not match the specified regular expression.

Syntax

The required syntax is in bold.

regex
(<field>=<regex-expression> | <field>!=<regex-expression> | <regex-expression>)

Required arguments

<regex-expression>
Syntax: "<string>"
Description: An unanchored regular expression. The regular expression must be a Perl Compatible Regular
Expression supported by the PCRE library. Quotation marks are required.

Optional arguments

<field>
Syntax: <field>
Description: Specify the field name from which to match the values against the regular expression.
You can specify that the regex command keeps results that match the expression by using
<field>=<regex-expression>. To keep results that do not match, specify <field>!=<regex-expression>.
Default: _raw

Usage

The regex command is a distributable streaming command. See Command types.

Use the regex command to remove results that match or do not match the specified regular expression.

Use the rex command to either extract fields using regular expression named groups, or replace or substitute characters
in a field using sed expressions.

When you use regular expressions in searches, you need to be aware of how characters such as pipe ( | ) and backslash
( \ ) are handled. See SPL and regular expressions in the Search Manual.

For general information about regular expressions, see About Splunk regular expressions in the Knowledge Manager
Manual.

Examples

Example 1: Keep only search results whose "_raw" field contains IP addresses in the non-routable class A (10.0.0.0/8).
This example uses a negative lookbehind assertion at the beginning of the expression.

... | regex _raw="(?<!\d)10\.\d{1,3}\.\d{1,3}\.\d{1,3}(?!\d)"

1
Example 2: Keep only the results that match a valid email address. For example, [email protected].

...| regex email="^([a-z0-9_\.-]+)@([\da-z\.-]+)\.([a-z\.]{2,6})$"

The following table explains each part of the expression.

Part of the
Description
expression
^ Specifies the beginning of the string.

This is the first group in the expression. Specifies to match one or more lowercase letters, numbers, underscores, dots,
or hyphens. The backslash ( \ ) character is used to escape the dot ( . ) character. The dot character is escaped,
([a-z0-9_\.-]+) because a non-escaped dot matches any character. The plus ( + ) sign specifies to match from 1 to unlimited characters
in this group. In this example this part of the expression matches buttercup in the email address
[email protected].

@ Matches the at symbol.

This is the second group in the expression. Specifies to match the domain name, which can be one or more lowercase
letters, numbers, underscores, dots, or hyphens. This is followed by another escaped dot character. The plus ( + ) sign
([\da-z\.-]+)
specifies to match from 1 to unlimited characters in this group. In this example this part of the expression matches
example in the email address [email protected].

This is the third group. Specifies to match the top-level domain (TLD), which can be 2 to 6 letters or dots. This group
([a-z\.]{2,6}) matches all types of TLDs, such as .co.uk, .edu, or .asia. In this example it matches .com in the email address
[email protected].

$ Specifies the end of the string.

Example 3: Filter out zip codes that are formatted like a United States zip code or zip+4 code. For example, this search
would return a Canadian zip code.

Splunk 8.2.3 SearchReference Regex

Uploaded by

Splunk 8.2.3 SearchReference Regex

Uploaded by

Splunk® Enterprise

Search Reference 8.2.3

Copyright (c) 2021 Splunk Inc. All Rights Reserved

The required syntax is in bold.

The regex command is a distributable streaming command. See Command types.

... | regex _raw="(?<!\d)10\.\d{1,3}\.\d{1,3}\.\d{1,3}(?!\d)"

...| regex email="^([a-z0-9_\.-]+)@([\da-z\.-]+)\.([a-z\.]{2,6})$"

The following table explains each part of the expression.

@ Matches the at symbol.

$ Specifies the end of the string.

... | regex not_usa_zip!="[0-9]{5}(-[0-9]{4})?"

You might also like