Splunk Regular Expressions: Rex Command Examples

Last updated:
Table of Contents

Rex vs regex

  • rex is used to extract fields
  • regex is used to filter rows (like the where clause)

Extract match to new field

Use named capture groups with the rex command:

Example extract occurrences of alphanumeric UUID order IDs (followed by whitespace) into a field called order_id:

your search criteria
| rex "order_id (?<order_id>[0-9a-z]) "

Field contains regex

regex acts as an extra search criteria!

Use command regex and the field you want to match on (can also be the _raw field)

Example: retrieve rows that match your search criteria and and contain a three-digit number

your search criteria
regex _raw="\d{3}"

Field matches regex

As a variation of the above, this only returns rows where the field fully matches the regex.

To do that, simply add ^ at the beggining and $ at the end of the pattern

Example: retrieve rows that match your search criteria and and only have lowercase letters or spaces

your search criteria
regex _raw="[a-z ]+"

Dialogue & Discussion