Splunk Search

regex delimiters & config file formatting

Gregory_Lapchen
Engager

I'm experiencing a subtle issue, which is not very apparent due to lack of delimiters around regular expressions, where the space after the '=' sign is being parsed as part of the regular expression. Considering most config files use spaces around the '=' sign for readability, this becomes confusing.

REGEX = info

This expression would match " info" vs "info". I.e. "abc info" would match, and "abcinfo" would not.

Is this expected behavior?

Tags (1)

aojie654
Path Finder

Hi, @Gregory Lapchenko:

I'll use _ in this answer to recognize space.
I feel sorry about that I'm not very clearly to understand your puzzle. From what I understand, are you want to match just _info but not abc_info? If so, maybe the regex expression is \s+info to match _info, or [^\s]*?\sinfo to match abc_info.

0 Karma

Boopalan
New Member

Below Regex will work as expected for you:
REGEX=\s+info

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can either use \s (which would match either a space or a tab) or [ ] (just the space) in a regex to represent a space, and it's usually a good idea to do so if you've got it at the beginning of a regex. I wonder if you might prefer to use \b (word boundary) before the info as well.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...