All Apps and Add-ons

Not a Splunk Question but a Regex Question

Dark_Ichigo
Builder

So basically Iv got a String: "Hello Splunk Today: 2011-08-11"

I want the Regular Expression to end the String when it Sees a Capital 'T' Or a Digit!

How can I do this, Im new to writing my own Regular expressions, so any help would be Awesome!

Thanks!

1 Solution

LukeMurphey
Champion

If you are new to regex's, then you may want to spend a little time playing with regular expressions before betting too deep in using them in Splunk. I recommend using a site like http://pythonregex.com/ to test them since you can see what it will do with some sample text.

For your particular problem, you can use a character class that matches everything but digits and the capitol "T":

[^T0-9]*

View solution in original post

Drainy
Champion

Thumbed up - it relates to Splunk so it certainly shouldn't get a down-vite

Dark_Ichigo
Builder

Why would someone thumbs me down?

0 Karma

LukeMurphey
Champion

If you are new to regex's, then you may want to spend a little time playing with regular expressions before betting too deep in using them in Splunk. I recommend using a site like http://pythonregex.com/ to test them since you can see what it will do with some sample text.

For your particular problem, you can use a character class that matches everything but digits and the capitol "T":

[^T0-9]*

Ayn
Legend

Another alternative thrown in for good measure: http://regexpal.com/

Drainy
Champion

Another fantastic site is http://gskinner.com/RegExr/ On there you can test regex on the fly with it updating as you type. I practically live there when doing alot of regex work

Dark_Ichigo
Builder

Thanks Luke

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...