Regex search for UUID based uri in splunk - regex

I am trying to search for all events which contain a UUID as part of a request url. Here is my query:
.... | regex requestURI=*/employee/[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}*
It gives error as:
Unknown search command '0'
What's the mistake I am making?

Try using " instead of *
.... | regex requestURI="/employee/[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}"
Now talking about the regex itself, but there is already a question for that. Check the answers here for the RegEx: Searching for UUIDs in text with regex
Some important points like case sensitivity etc. are discussed there.

Related

Regex for bigquery to return all paths after /api

I am using dataset of github to extract all paths after /api/* and for that I used this below-mentioned query. However, the results are not what I expected it to be. If the regex is wrong can someone please correct it?
Expected results:
/api/v1/user
/api/anything/anything
What actually returns:
Frameworks/TwitterKit.framework/Resources
doc/source/README.rst
*
FROM
`bigquery-public-data.github_repos.files`
WHERE
(REGEXP_CONTAINS(path,r'(s|^.*/api/([^/]*)(?:/.*)?$|$1|)'))
LIMIT
100```
You are using a Perl substitution command in the regex pattern. Look:
s|^.*/api/([^/]*)(?:/.*)?$|$1 |
|| |RHS
||___pattern______________|
|___ action
where RHS (right-hand side) is the replacement.
You only need to use a pattern in BigQuery. To match your desired strings, you may use
^/api/[^/]*(?:/.*)?$
See the RE2 regex demo.
SELECT * FROM `bigquery-public-data.github_repos.files`
WHERE REGEXP_CONTAINS(path,r'^/api/[^/]*(?:/.*)?$')
LIMIT 100
If the regex is wrong can someone please correct it?
#standardSQL
SELECT *
FROM `bigquery-public-data.github_repos.files`
WHERE REGEXP_CONTAINS(path, r'/api/.*')
LIMIT 100
Meantime, note: title of your question is not consistent with question body - REGEXP_CONTAINS in WHERE clause just allows you to return all rows with searched pattern in path - but does not extract the pattern.
To extract pattern - you need to use REGEXP_EXTRACT(path, r'/api/.*') in SELECT statement.

regex to convert custom property file to json key value pair representation

I have a partial solution to convert this
USERNAME=CONSTANT[myUserName]
PASSWORD=CONSTANT[mypwd]
to
"USERNAME":"myUserName",
"PASSWORD":"mypwd"
I see a similar solution here
properties file to json. Basically I am looking for zero or more spaces 1.) anywhere before or after a key 2.) before and after = sign
USERNAME = CONSTANT[myUserName]
PASSWORD = CONSTANT[mypwd]
Find What: (^[^ \t]+)(\s.*=\s*CONSTANT\[)(.*[^\n])(\])
Replace: "$1":"$2",
"USERNAME":"myUserName",
"PASSWORD":"mypwd",
Also I want to make sure I do this for each line and some times it matches multiple lines which is wrong. I hope one can find a solution that works in Eclipse on Windows.
Make sure to use ^ and $ in order to avoid your regex matching multiple lines. Try something like this:
^\s*(\w+)\s*?\=\s*?\w+\[(\w+)\]$
Replace with:
"$1":"$2",
Demo: https://regex101.com/r/mxF8lI/1/

in regex get a single match just before the match pattern?

I have a response like below
{"id":9,"announcementName":"Test","announcementText":"<p>TestAssertion</p>\n","effectiveStartDate":"03/01/2016","effectiveEndDate":"03/02/2016","updatedDate":"02/29/2016","status":"Active","moduleName":"Individual Portal"}
{"id":103,"announcementName":"d3mgcwtqhdu8003","announcementText":"<p>This announcement is a test announcement”,"effectiveStartDate":"03/01/2016","effectiveEndDate":"03/02/2016","updatedDate":"02/29/2016","status":"Active","moduleName":"Individual Portal"}
{"id":113,"announcementName":"asdfrtwju3f5gh7f21","announcementText":"<p>This announcement is a test announcement”,"effectiveStartDate":"03/02/2016","effectiveEndDate":"03/03/2016","updatedDate":"02/29/2016","status":"InActive","moduleName":"Individual Portal"}
I am trying get the value of id (103) of announcementName d3mgcwtqhdu8003.
I am using below regEx pattern to get the id
"id":(.*?),"announcementName":"${announcementName}","announcementText":"
But it is matching everything from the first id to the announcementName. and returning
9,"announcementName":"Test","announcementText":"<p>TestAssertion</p>\n","effectiveStartDate":"03/01/2016","effectiveEndDate":"03/02/2016","updatedDate":"02/29/2016","status":"Active","moduleName":"Individual Portal"}
{"id":103,"announcementName":"d3mgcwtqhdu8003","announcementText":
But I want to match only from the id just before the required announcementName.
How can I do this in RegEx . Can someone please help me on this ?
As an answer here as well. Either use appropriate JSON functions, if not, a simple regex like:
"id":(\d+)
will probably do as the IDs are numeric.

Case Insensitive Regex expression for getting file

I have a scenario where i am taking files from a folder for data loading which is having naming convention as .Customer_..txt.But also i would like to make this expression case insensitive so if any file named CUSTOMER_1234 comes.It will also accept that and process accordingly
Try the below regex:
(?i)customer(?-i).*\.txt
in the wildcard section of the "get files" steps or any other regex step you are using. This will filter out files starting with either "customer" or "CUSTOMER".
Attached a sample code here.
Hope this helps :)
Sample Screenshot:
Modifying my previous answer based on the comment below:
If you are looking to match the pattern "customer_" irrespective of case sensitivity, first of all you can easily do it using a Javascript "match" function. You just need to pass the file names in upper case and match with the uppercase pattern. This will easily fetch you the result. Check the JS snip below:
var pattern="customer_"; //pattern is the word pattern you want to match
var match_files= upper(files).match(upper(pattern)); // files in the list of files you are getting from the directory
if(upper(match_files)==upper(pattern)){
//set one flag as 'match'
}
else{
// set the flag as 'not match'
}
But in case you need to use regex expression only. Then you can try the below regex:
.*(?i)(customer|CUSTOMER).*(?-i)\.txt
This would work for "_123_Customer_1vasd.txt" patterns too.
Hope this helps :)

Regular Expression for get data between \ (backslash) and first . (dot)

I`m trying to setup my calibre (calibre-ebook.com) to automatic get data from imported pdf files into library.
Usually i name my files this way:
Author. Title. Local. Publisher. Published. ISBN.pdf
Example:
C:\Test\RANCIÊRE, Jacques. O mestre ignorante. Belo Horizonte. Autêntica. 2010. 978-85-7526-045-6.pdf
I`m stuck trying get the first paramenter: Author, using the regex:
([^\\]+)\.
I`m getting this value:
RANCIÊRE, Jacques. O mestre ignorante. Belo Horizonte. Autêntica. 2010. 978-85-7526-045-6
Since regex read from left to right isn`t to stop on first dot (.) from .?
The desired value on this example is:
RANCIÊRE, Jacques
Any hint for the other fields? Example for Title the desired value is:
O mestre ignorante
Thanks in advice!!!
^.+?\. will get you the C:\Test\RANCIÊRE, Jacques.
it means get the all characters before the first dot.
if you want only RANCIÊRE, Jacques than use:
(?!(.*\\))(.+?\.)
will give you RANCIÊRE, Jacques.
Regex capturing is greedy, meaning it tries to get the largest match as possible. Try the non-greedy version:
([^\\]+?)\.
Note the only difference is the addition of a ?.
Afterwards, you should be able to retrieve the author's name ("RANCIÊRE, Jacques") with just \1.