Splunk Search

Need to understand the following expression.

Nicksyboy
Explorer

I recently came across a Splunk expression, as

rex "(?i)\".*? (?P/\w+/((\w+\.\d+)|(\w+\d+))/((\w+/)|(\w+/\w+/)|((\w+/\w+/\w+/)))\D+((\?)|(\s)))\w+"

and due to the usage of toom many forward and backward slash, I am unable to understand it. Can you please help me in the matter?

Tags (1)
0 Karma
1 Solution

gelica
Communicator

I like this site alot for checking regexes: http://www.regexper.com/

The regex needed a little modification, but only escaping "/"
This is the regex I ran to get the site to work:

.*? (\/\w+\/((\w+\.\d+)|(\w+\d+))\/((\w+\/)|(\w+\/\w+\/)|((\w+\/\w+\/\w+\/)))\D+((\?)|(\s)))\w+

View solution in original post

gelica
Communicator

I like this site alot for checking regexes: http://www.regexper.com/

The regex needed a little modification, but only escaping "/"
This is the regex I ran to get the site to work:

.*? (\/\w+\/((\w+\.\d+)|(\w+\d+))\/((\w+\/)|(\w+\/\w+\/)|((\w+\/\w+\/\w+\/)))\D+((\?)|(\s)))\w+

lukejadamec
Super Champion

Pull a fieldname that is followed by a / then one or more letters followed by a /, which will be followed by one of the following:

one or more letters followed by a . followed by one or more digits, or

one or more letters followed by one or more digits.

This will be followed by a / and then one of the following:

One or more letters, or

One or more letters followed by a / then one or more letters followed by a /, or

One or more letters followed by a / then one or more letters followed by a / then one or more letters followed by a /

This will be followed by one or more Non-digits.

I think that covers all of the /shs.

lukejadamec
Super Champion

You should accept the answer so others know the issue is closed.

0 Karma

lukejadamec
Super Champion

You are welcome.

0 Karma

Nicksyboy
Explorer

Thanks guys for your quick response!

0 Karma

lukejadamec
Super Champion

little d means digit, big D means not a digit. Same with w and W for a letter.

grijhwani
Motivator

s is any whitespace character.

Nicksyboy
Explorer

Thanks for the quick response! So - \w is for words, \d is for digits. What is D and S stands for?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...