# Splunk Regular Expressions: Rex Command Examples

Last updated:

## Rex vs regex

• rex is used to extract fields
• regex is used to filter rows (like the where clause)

## Extract match to new field

Use named capture groups with the rex command:

Example extract occurrences of alphanumeric UUID order IDs (followed by whitespace) into a field called order_id:

your search criteria
| rex "order_id (?<order_id>[0-9a-z]) "


## Field contains regex

regex acts as an extra search criteria!

Use command regex and the field you want to match on (can also be the _raw field)

Example: retrieve rows that match your search criteria and and contain a three-digit number

your search criteria
regex _raw="\d{3}"


## Field matches regex

As a variation of the above, this only returns rows where the field fully matches the regex.

To do that, simply add ^ at the beggining and \$ at the end of the pattern

Example: retrieve rows that match your search criteria and and only have lowercase letters or spaces

your search criteria
regex _raw="[a-z ]+"