Implementing Splunk 7, Third Edition - Third Edition

A regular expression primer

Most of the ways to create new fields in Splunk involve regular expressions (sometimes referred to as regex). As mentioned in the Splunk documentation:

"Regex is a powerful part of the Splunk search interface, and understanding it is an essential component of Splunk search best practices"

There are many books and sites dedicated to regular expressions, so we will only touch upon the subject here. The following examples are really provided for completeness; the Splunk web interface may suffice for most users.

Given the log snippet ip=1.2.3.4, let's pull out the subnet (1.2.3) into a new field called subnet. The simplest pattern would be the following literal string:

ip=(?P<subnet>1.2.3).4 

This is not terribly useful ...