Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF










Required arguments


Syntax: "<string>"
Syntax: mode=sed
Syntax: "<string>"

Optional arguments

Syntax: field=<field>
Description: The field that you want to extract information from.
Default: _raw
Syntax: max_match=<int>
Default: 1, use 0 to mean unlimited.
Syntax: offset_field=<string>
Default: unset

Sed expression









Splunk SPL uses perl-compatible regular expressions (PCRE).




1. Extract email values using regular expressions












Example 2:



Example 3:



Example 4:

Display IP address and ports of potential attackers.



See also

extract, kvform, multikv, regex, spath, xmlkv




your cisco_esa example search might be rewritten as a multi-line query:

| rex field=_raw "(?ix)
| dedup from to
| table from to

... granted this example is a little contrived, but is at least complex enough to show what I meant. note that the string is split across multiple lines and is intended for legibility - in order to actually match spaces, I need to use \s now. It's redundant, but I've also set it to be case-insensitive[1] and modified the field names to show that too.

why might you do this? well, the advantage of having strings containing regular expressions that set their own flags is that you can then include them in other strings to build more complex expressions and with a bit of care, each will be usable in those other contexts without requiring modification.

[1] I can't recall whether rex matches case or not by default - this is at least more explicit

September 18, 2019

a note on how to use in-string flags to allow for multi-line regular expressions could also be very very useful - (?ix) at the beginning of the string tells rex to ignore case and ignore whitespace in the string. This allows you to then split your regular expression across multiple lines in your query to make them easier to develop ... the drawback is that you then MUST use \n, \r, \s, or \t in order to match whitespace

September 18, 2019

I used https://regex101.com/ to test your regex. It indicated that you need to escape your forward slashes, because they are being read as a delimiter. So the correct regex expression is


Lstewart splunk, Splunker
April 8, 2019


Thank you for taking the time to leave feedback on the REX command and specifically about including more examples. We are always looking for ways to make using the documentation easier and your comments help us focus those efforts.

For the "max_match" argument, by default the command returns the first match it finds. If you want the command to return multiple matches from the same event, you can set max_match to a higher value. If you specify "max_match=0", it will return all matches that it finds in each event.

If you have an example of data where this would be useful, would you mind sharing that with us? We are always looking for real world examples to add to the documentation. People use the commands for so many different purposes that having a variety of examples is helpful.

Lstewart splunk, Splunker
April 8, 2019

when you have multiple matches in one event, it returns <null>, is this desired?
"some text /search_me-1/ something /search_me-2/ something else"
| rex "(?P<result>/search_me[^\/]*)/" | table result
splunk version: 6.5.2

April 5, 2019

The syntax above uses 'max_match', however, none of the examples that follow demonstrate usage of this optional argument. It would additionally have been great if an example could have been given using ALL/ as many of the 'rex' command's parameters as possible, to illustrate how ALL of these arguments would like in a real-world usecase. If such examples were intentionally left out, sufficient links (such as this: https://docs.splunk.com/Documentation/Splunk/7.2.0/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration) should have been included for the user to easily navigate and find the desired explanation. But there too, there are no examples. This only bears out the general experience of using Splunk documentation - it is tedious to look for examples and/ or clearly-explained usages of Splunk keywords/ commands. The documentation is not exhaustive or succinct and requires a user to traverse & search in SEVERAL pages to glean the necessary (& usable) information. Thank you

April 1, 2019

Pyamamoto yes you can do this (see below). I'd recommend https://answers.splunk.com for more visibility into the question.


February 12, 2019

Is there a way to have the sed result be assigned to a new field name instead of modifying the specified field? Example where a "host" field contains a "host-type" naming scheme prefix followed by an instance number eg "my-host-type-1234.company.com" | rex field=host mode=sed 's/-1234.*$//' would modify host but I don't want host modified, I want to make it host-type... note that a regex to match the prefix is a bit more involved due to the "-xxxx" and not wanting a trailing -, for example rex field=host "(?<host-type>*[^0-9]*)[0-9]" is almost there but keeps a trailing "-".

February 4, 2019

Reneedeleon - Thanks for reaching out to us with your question. Splunk does not have videos or books specifically aboutcreating regular expressions. However we do have several topics about them here:


There are a number of online resources, such as www.regular-expressions.info
and there are books such as Mastering Regular Expressions by O’Rielly http://shop.oreilly.com/product/9780596528126.do

Additionally, you can google for “regex videos” for a list of videos.

Hope this helps!

Lstewart splunk, Splunker
October 5, 2018

Is there, or are the video tutorials or books that can help with people who have trouble generating custom rex and/or regex strings?

October 3, 2018

Was this documentation topic helpful?





0 out of 1000 Characters