Splunk Regex Cheat Sheet

Posted : admin On 1/3/2022

I’m the Splunk Marine; meaning I’m both a Splunker and a Marine. After five months of working at Splunk, I realized some of my core Unix and Linux skills were getting a little rusty. In a former life, I was a Linux Systems Engineer for a government agency, so it’s important to me to keep those skills sharp. One of the most important skill sets as a Unix/Linux Systems Engineer, in my opinion, is the ability to utilize a console based text editor. My editor of choice is VI, although many prefer EMACS. Many of these console based text editors are quite complicated. One of the things I do to both remember all the commands for VI and try to stay sharp in that specific skillset is to set my desktop background as a VI cheat sheet. This is especially important, as Splunk configuration files are all editable text files. With some well-developed VI skills, it makes it quite easy to configure or reconfigure your Splunk installs, especially those installs such as the Universal Forwarder, which does not have a Splunk Web UI. So here:

  1. Splunk Regex Cheat Sheet Download
  2. Splunk Regex Cheat Sheet Example
Splunk regex filter

is the cheat sheet I use. It’s not an all-inclusive cheat sheet, but it covers about 90% of the commands that are available to you in VI. One other interesting fact is that VI is the only text editor, by default, that is built into all Unix/Linux operating systems. I hope this tidbit of information is helpful to you. Please check back soon for more Tips and Tricks from this old Jarhead.

9.3k members in the Splunk community. SANS Cheat Sheet to Cheat Sheets. Manually do field extractions with a custom regex that I made but the sourcetype. The idea is simply to save some quick notes that will make it easier for Splunk users to leverage KQL (Kusto), especially giving projects requiring both technologies (Splunk and Azure/Sentinel) or any other hybrid environments. For general information about regular expressions, see About Splunk regular expressions in the Knowledge Manager Manual. Example 1: Keep only search results whose 'raw' field contains IP addresses in the non-routable class A ( This example uses a negative lookbehind assertion at the beginning of the expression. Splunk’s Machine Learning capabilities are integrated across our portfolio and embedded in our solutions through offerings such as the Splunk Machine Learning Toolkit, Streaming ML framework, and the Splunk Machine Learning Environment. SPL2 Several Splunk products use a new version of SPL, called SPL2, which makes the search.

Splunk Regex Cheat SheetSplunk regex cheat sheet pdf

Semper Fi!

Splunk Regex Cheat Sheet Download

Splunk Regex Cheat Sheet

For your convenience:

  • Links to the above cheat sheet:
  • Link to EMACs cheat sheet:
Splunk Regex Cheat Sheet
  • Link to Splunk quick reference for RegEx:

Splunk Regex Cheat Sheet Example

Mark White