CODEWITHSUNDEEP
regexregex-negationsplunkregex-lookarounds
dahui
dahui

Reputation: 2166

Regular expression, match anything but these strings

Within Splunk I have a number of field extractions for extracting values from uri stems. I have a few which match a specific pattern, I now want another regex which matches anything but these.

^/SiteName/[^/]*/(?<a_request_type>((?!Process)|(?!process)|(?!Assets)|(?!assets))[^/]+)

The regex above is what I have so far. I am expecting the negative lookaheads to prevent it from matching Process, process, assets or Assets. However it seems that the [^/]+ after these lookaheads can then go ahead and match these strings anyway. Resulting in this regex sometimes overriding the other regexes I wrote to accept these strings

What is the correct syntax for me to make the regex match any string, other than those specified in the negative lookaheads?

Thanks!

Upvotes: 1

Views: 567

Answers (1)

Archimaredes
Archimaredes

Reputation: 1427

Negative lookaheads do not consume any of the string being searched. When you want multiple negative lookaheads, there is no need to separate them with | (OR). Try this:

^/SiteName/[^/]*/(?<a_request_type>((?![Pp]rocess)(?![Aa]ssets))[^/]+)

Note that I have combined your lookaheads ([Pp]rocess and [Aa]ssets) to make the regular expression more concise.

Live test.

Upvotes: 3

Related Questions