Splunk Search

good regex (fast)

mcbradford
Contributor

I have a field called "user". I am looking for matches that contain 6 or 7 characters, and always end with "a" but does not end in "pa".

I am using the following and it works, but I was wondering if someone might have a better regex expression that would be faster?

regex user=".+[^p]a$"

Tags (1)
0 Karma

tpflicke
Path Finder

Just a hint how to quickly test some regular expressions without having the data in splunk using eval - the examples below show tests against the regex given by jgreenleaf

index=* | head 1 | eval user="12345pa" | regex user="^.{5,6}(?<!p)a$" | table user

index=* | head 1 | eval user="123456a" | regex user="^.{5,6}(?<!p)a$" | table user
0 Karma

jgreenleaf
Explorer
^.{5,6}(?<!p)a$

should do what you want

mcbradford
Contributor

This worked, but it is about as fast as my originally regex.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Technically, your regex will match any length string that starts with at least one character followed by the letter 'a' (as end of string) without a letter 'p' coming before that letter 'a'. This means that it would match user="1a" or user="mydata" or user="my other data here a" so if you need to restrict to only a full string length of 6 or 7 characters, you are really looking for regex that looks for "5 or 6 of any character, followed by a letter 'a' to end the string, as long as there is not a letter 'p' immediately before the last letter 'a'" right?

Perhaps this will work:

^.{5,6}(a|[^p]a)$
--
Jesse Trucks
Minister of Magic

jtrucks
Splunk Employee
Splunk Employee

Hmm. odd. I edited the entry to show string termination at the end. I don't have data in splunk to test this exact string, so it might need some tweaking. The above IS pure PCRE syntax, however. If you don't care the length of the string, your regex is perfectly fine and fast enough…

--
Jesse Trucks
Minister of Magic
0 Karma

mcbradford
Contributor

This found besmanager???

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't have data to test it but this is also an options.

| where LIKE(user,"%a") AND NOT LIKE(user,"%pa")

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...