Splunk Search

What sort of regular expressions does splunk use?

msarro
Builder

Just curious about this. Most of the regular expressions I see splunk use look nothing like standard/posix regular expressions. Its making it a bit annoying for me.

Tags (1)
1 Solution

ftk
Motivator

niketn
Legend

While it is PCRE for all other places, only for <eval> tags in the dashboard to set the token, Splunk Uses JavaScript Regular Expression.
Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

Obviously while using Simple XML JS Extension to Splunk Simple XML Dashboards also we would use JavaScript Regular Expressions.

Refer to following amazing talk by @cpetterborg for .conf 2017: Beyond Regular Regular Expressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

scorrie_splunk
Splunk Employee
Splunk Employee

From the Knowledge Manager Manual:
"Splunk regular expressions are PCRE (Perl Compatible Regular Expressions) and use the PCRE C library."
Link: http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions
(Link updated)

0 Karma

niketn
Legend

@scorrie I think you meant the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

scorrie_splunk
Splunk Employee
Splunk Employee

Yes, I pasted the wrong one, and have fixed it. Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust
0 Karma

ftk
Motivator

msarro
Builder

Great, thank you!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

also useful: http://www.pcre.org/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...