Splunk Search

Regex "(?<!\d)"

boris
Path Finder

What does the regex in my question's title above mean?

Source: Search Language Quick Reference Card (on top of page 3)

Context: "(?<!\d)" is part of this full example:

| regex _raw="(?<!\d)10.\ d{1,3}\.\d{1,3}\.\d{1,3} (?!\d)"

for finding this type of string:

10.0.0.0/8

I understand this part:

10.\ d{1,3}\.\d{1,3}\.\d{1,3}

10.0.0.0

I am also uncertain about this end part:

(?!\d)
Tags (1)
0 Karma
1 Solution

boris
Path Finder
(?<!a)b

matches a "b" that is not preceded by an "a"

Example:

(?<!\d)f 

would find the letter f as long as it wasn't like 5f.

(?<=a)b 

is the opposite. A positive look behind.

View solution in original post

0 Karma

boris
Path Finder
(?<!a)b

matches a "b" that is not preceded by an "a"

Example:

(?<!\d)f 

would find the letter f as long as it wasn't like 5f.

(?<=a)b 

is the opposite. A positive look behind.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...