Splunk Search

How do you incorporate the following regex into a search?

nls7010
Path Finder

How can I get this in a regex that I can use in Splunk?

/[^aA-zZ].[0-9].log

I need to create an alert that looks at /home///log/*** and picks up only what matches the above string.

How can I put that in a search in Splunk?

Tags (2)
0 Karma

michael_schmidt
Path Finder

Try this:

source=/home///log/*| rex field=source "(?P[^aA-zZ].[0-9].log)"

Regardless, the command you need is the rex field=fieldname"regex_goes_here" part to get the regex working within the search.

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...