Why doesn't this regex work?

Question

Let's say I have these 2 events in my index:

04-06 15:56:03 This is another log line of text 654321
04-06 15:55:03 This is a log line of text 123456

I can simply enter index="test" log on the search bar and will see both events return, however, if I enter index="test" regex="log" in the search bar, it returns 0 events. This regex is valid PCRE. Entering index="test" regex=".*log.*" doesn't return any results either.

Answer 1

3

With regex="log" you're actually performing a field search on the field regex. You probably want to use the regex command instead.

index=test | regex _raw="log"

link

answered 06 Apr '11, 19:06

ziegfried ♦
10.1k●1●6●18
accept rate: 52%

1

Or, when you just need basic wildcard matches, you can skip the regex processing altogether and use "log" instead of the regex "log."

(08 Apr '11, 04:02) southeringtonp ♦

Why doesn't this regex work?

Follow this question

Splunk Resources

Related questions