Regular expression splunk query [duplicate] - regex

This question already has answers here:
Getting the text that follows after the regex match
(5 answers)
Closed 4 years ago.
I have a line containing
[India,sn_GB] Welcome : { Name:{Customer1},Place:{Mumbai},}
I want to print the entire line after sn_GB] in splunk, which is
Welcome : { Name:{Customer1},Place:{Mumbai},}
I used the below regular expression:
(?<=sn_).*?$
But it prints, along with GB] like GB] Welcome : { Name:{Customer1},Place:{Mumbai},}.
In the word sn_GB, sn_ is constant and the rest two letter will vary, like GB, LB, KB, TB as such.
Please help me in correcting the regular expression.
Thanks

This will give the correct result in case sn_GB is constant.
(?<=sn_GB).*?$
If GB is not constant you can go for:
(?<=sn_...).*?$

I understand your question now.
Country codes are always 2 letters.
i'd use
(?<=sn_..\]\ ).*$
but you could use
(?<=sn_[A-Z]{0,5}\]\ \s*).*?$
(?<=sn_....).*$
is the simplest, as it will just grab 4 characters after, if it's always 2 letters for country code, and then a closing bracket and a space

Related

Use RegEx to Search for Term and Extract Characters Before and After It [duplicate]

This question already has answers here:
How to match "any character" in regular expression?
(12 answers)
Closed 2 years ago.
I'm struggling to find the correct syntax to use that will parse a page for a term and then output any 100 characters (HTML included) before the term + the term + any 100 characters after the term.
I'm using Screaming Frog to search my website and I need to see the context for each occurrence of the term.
So I would want my output to look something like:
...i>two</li></ul><h4>title</h4>Help me this is my TERM and i want to view things. Can you se...
Any suggestions?
To match up to 100 chars before and after a term:
.{0,100}TERM.{0,100}

Regex Help for User ID [duplicate]

This question already has an answer here:
Learning Regular Expressions [closed]
(1 answer)
Closed 2 years ago.
Fairly new to regex, looking to identify a user id pattern that is all alpha, is exactly 6 characters, and the second character is always a Z. Any help would be appreciated.
How about this regex:
\w(Z|z)\w{4}
Is this what you want?
As I understood you want something to detect something like this:
jZabcd
What you could do is something like this:
[A-Za-z][Z]([A-Za-z]{4})
Breakdown:
[A-Za-z] = detects all alpha big and small letters only once.
[Z] = checks if there is only a big "Z".
() = a group to make it easier.
{4} = checks if there is 4 times from what was infront of the 4.
[A-Za-z]{4} = checks if there are 4 letters from big A-Z and small a-z.
I hope this helps you out and please expand your question next time a little more.

Remove last character from regex match [duplicate]

This question already has answers here:
How can I match "anything up until this sequence of characters" in a regular expression?
(15 answers)
Closed 3 years ago.
I have strings that are concatenations of airline codes/flightnumbers, separated with ;. The airline code and flight number are either separated by a space or -. So some examples are:
AA-1234;UA 243;EK 23;
9W 23;B6-134
Now I want to grab the airline codes from this.
I came up with the following regex: [a-zA-Z0-9]{2}[ -]. This works to grab the airline codes but also includes the airlinecode-flightnumber separator. How would I adjust my regex to not include this?
[a-zA-Z0-9]{2}(?=[ -])
See it in action here

How to get specific data from String using regex in java? [duplicate]

This question already has answers here:
how can I exctract attribute value using JAVA regex
(2 answers)
Closed 4 years ago.
I have a string.
String str= " <decision CCDBNUM=\"1111111\" adddate=\"20180112\"><decision CCDBNUM=\"2222222\" adddate=\"20180114\"> ";
I want to write a regex to fetch a particular value from this string.
My Expected Output is: to fetch only the value of CCDBNUM, i.e,
1111111 2222222
Please help me with this issue.
This should work:
CCDBNUM="([^"]+)"
Just get group 1 of each match.
I assume that CCDBNUM wouldn't contain the characters CCDBNUM. If that's not the case, I suggest you use an XML parser. Regex is not enough for that.
Demo

reformat numbers using regex [duplicate]

This question already has answers here:
How to validate phone numbers using regex
(43 answers)
Closed 6 years ago.
I have a file that contains any of the following number format
12.456.7890
12-456-7890
123.456.7890
(123)456.7890
(123).456.7890
123-456-7890
(123)-456-7890
(123)456-7890
Is it possible to use regex substitution so that the final output number will always be on a format (123)456-7890 or (12)456-7890
Yes, it is:
s/\(?(\d\d\d)\)?[-.]?(\d\d\d)[-.]?(\d\d\d\d)/($1)$2-$3/g
I should mention that the above will also parse the following two:
123)456.7890
(123456.7890
You can do this using two substitutions:
perl -lpe 's/\D//g; s/(\d{3})(\d{3})(\d{4})/($1)$2-$3/' file
The first one removes all characters that aren't numeric. The second one inserts the desired characters between each group.
You should take into account that this approach will make a mess of any lines that aren't like the ones in your sample input. One means of protecting yourself could be something like this:
if ((#a = /\d/g ) == 10) { /* perform substitutions */ }
i.e. ensure that the number of matches on the line is 10 before proceeding.