Splunk Search

Regex help

vlape_SCWX
New Member

I am at a loss as to why the following is not working.
log:
2020-03-31 20:31:19,621 fail2ban.actions [709]: NOTICE [sshd] Unban 156.38.x.x
Query
index=main fail2ban.actions | regex _raw="[(?sshd)]" | fields jail
I have double checked the regular expression with regex101 and "sshd" is captured in group jail.
Am i missing something?
Splunk Enterprise 8.0.2.1

Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
 index=main fail2ban.actions sshd
| rex "\[(?<jail>[a-z]+)\]"
| fields jail

regex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
rex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

what do you want to do?
[is meta character.
your | regex _raw="[(?<jail>sshd)]" searches the word sshd

see following:

  \       general escape character with several uses
  ^      assert start of string (or line, in multiline mode)
  $      assert end of string (or line, in multiline mode)
  .      match any character except newline (by default)
  [      start character class definition
  |      start of alternative branch
  (      start subpattern
  )      end subpattern
  ?      extends the meaning of (
         also 0 or 1 quantifier
         also quantifier minimizer
  *      0 or more quantifier
  +      1 or more quantifier
         also "possessive quantifier"
  {      start min/max quantifier

https://www.pcre.org/original/doc/html/pcrepattern.html

View solution in original post

0 Karma

to4kawa
Ultra Champion
 index=main fail2ban.actions sshd
| rex "\[(?<jail>[a-z]+)\]"
| fields jail

regex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
rex: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

what do you want to do?
[is meta character.
your | regex _raw="[(?<jail>sshd)]" searches the word sshd

see following:

  \       general escape character with several uses
  ^      assert start of string (or line, in multiline mode)
  $      assert end of string (or line, in multiline mode)
  .      match any character except newline (by default)
  [      start character class definition
  |      start of alternative branch
  (      start subpattern
  )      end subpattern
  ?      extends the meaning of (
         also 0 or 1 quantifier
         also quantifier minimizer
  *      0 or more quantifier
  +      1 or more quantifier
         also "possessive quantifier"
  {      start min/max quantifier

https://www.pcre.org/original/doc/html/pcrepattern.html

0 Karma

vlape_SCWX
New Member

That worked! thanks you. Why is it when I search for the exact match it returns nothing?

0 Karma

to4kawa
Ultra Champion

regex is search, not field extract command.
so, field jail is missing.

0 Karma

niketn
Legend

@vlape_SCWX can you try something like the following:

index=main fail2ban.actions 
| rex "\[(?<jail>sshd)\]" 
| table jail _raw

Not sure what you want to pull with hard-coded sshd

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vlape_SCWX
New Member

For some reason the \ before [ was stripped when posting the question.

0 Karma

vnravikumar
Champion

Hi

Use Code Sample or press Ctrl +k while posting your query

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...