Splunk Search

Need help with regex in transforms.conf to find two words in an event

gerdhuber
Explorer

Hallo,
i have to filter the following literals in an event and i am new in regex:

user:info
ifconfig

both literals must be in that event.

this don't works:
^.?\buser:info\b.?\bifconfig\b.*?$

Thank you for helping
Gerd

Tags (2)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

If you are coding the initial search, rather than using data that has already been pulled by some prior search, then this search will return only records on the index called "foo" which have both your search terms...

index=foo  "user:info" "ifconfig"

For an initial search, that is the most efficient way.


On the other hand, if you are trying to reduce a prior selection to only records which have both those fields, you could use either of these...

| search  "user:info" AND "ifconfig"

or

| regex field=_raw "^.*?user:info.*?ifconfig.*$"

This regex will match events that have the two terms in that order...

^.*?user:info.*?ifconfig.*$

There are additional things you could do to make the regex marginally more efficient when it FAILS to match the event, but that's all you really need.

Note: in some contexts the : may need to be escaped, so the regex would look like this...

^.*?user\:info.*?ifconfig.*$

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

(?ms)(?:user:info.*ifconfig)|(?:ifconfig.*user:info)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

If you are coding the initial search, rather than using data that has already been pulled by some prior search, then this search will return only records on the index called "foo" which have both your search terms...

index=foo  "user:info" "ifconfig"

For an initial search, that is the most efficient way.


On the other hand, if you are trying to reduce a prior selection to only records which have both those fields, you could use either of these...

| search  "user:info" AND "ifconfig"

or

| regex field=_raw "^.*?user:info.*?ifconfig.*$"

This regex will match events that have the two terms in that order...

^.*?user:info.*?ifconfig.*$

There are additional things you could do to make the regex marginally more efficient when it FAILS to match the event, but that's all you really need.

Note: in some contexts the : may need to be escaped, so the regex would look like this...

^.*?user\:info.*?ifconfig.*$
0 Karma

gerdhuber
Explorer

Thank you

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

When you post code, be sure to highlight the code and press the "code" button - it looks like 101 010. That will keep the interface from treating the characters in the code as html or formatting commands.

0 Karma

adonio
Ultra Champion

would be helpful if you can share full event.
also try and use regexr or regex101

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...