Splunk Regular Expressions: Rex Command Examples

Last updated:
Table of Contents

WIP Alert This is a work in progress. Current information is correct but more content may be added in the future.

Rex vs regex

rex regex
Use to extract fields
matching the expression
Use to filter rows
(like the where clause)

Extract match to new field

Use named capture groups (within <?...>) with the rex command:

Example extract occurrences of alphanumeric UUID order IDs (followed by whitespace) into a field called order_id:

your search criteria
| rex field=_raw "order_id (?<order_id>[0-9a-z]+) "

Field contains regex

regex acts as an extra search criteria!

Use command regex and the field you want to match on (can also be the \_raw field)

Example: retrieve rows that match "search criteria" and and contain a three-digit number

"search criteria"
| regex _raw="\d{3}"

Field matches regex

As a variation of the above, this only returns rows where the field fully matches the regex.

To do that, simply add ^ at the beggining and $ at the end of the pattern

Example: retrieve rows that match "search criteria" and and only have lowercase letters or spaces

search criteria
| regex _raw="[a-z ]+"

Character classes

Class Description
\w letters, digits and underscore

Dialogue & Discussion