Regular Expressions can be used in different Measure definitions, e.g.: URI Pattern or Cookie Values. Regular Expressions are very powerful but sometimes a little hard to write if you are not dealing with them on a day to day basis. Therefore I want to use this page to collect useful Regular Expressions that people use in their dynaTrace Installation. This will make it easier for all of us to leverage RegEx for our measures.

Besides the built-in Regular Expression Tester in most dynaTrace dialogs you can also check out this online regex testing service:

For a documentation of RegEx syntax please see

Pulling a value from a method argument, e.g.: XML field

Full Method Argument:

<XML File> Value1="1234" Value2="5678" WantedValue="AndiG" Lots of stuff </XML File>





Parsing Cookie Value, e.g.: JSESSIONID

Full Cookie Text:

VALUE_A=Stuff; JSESSIONID=f423cc8100ab1990e70e4c34c4d8; JROUTE=HZrB;MORECOOKIES






Parsing Header/Session/Cookie/Attrib - Easy Way middle or end

Just plug in (.*)

Full Method Argument:



domain/(.*)       or   domain/(.*)@

Returns:   or user

Parsing EMail Address from a Cookie

The following allows you to extract an email value from a key/value pair where the keyname is userid. Can for instance be used when an email is passed in a Cookie.

Full Cookie Text:





Extracting a part of an URI

for e.g. a Business Transaction Split Measure






Identify Classes Ending with a Certain String (limited to [cls] or [bas])


MyClass[cls] or MyOtherClass[bas]



Extract String of a constant length

The following allows you to extract a string that is of 20 character length. The string of interest is the value after corellationid.

Full String Text:

>>subtractResult= >>>result=2, corellationid=vamsitest987654321, _env= >>>locale=, tag=166, activation=wm6ed6e9c70-bcc3-11e2-81a2-e32be605e442,




  1. Can anybody help me to extract "Click on Search Button" from below string using regEx using BTM

    "JSESSIONID=CJJpPGTGzGFqnyGvsxK4Vmw4Xn1Y8f0rqwvJKLZKlJvFxs4z9jQw!1830662019; UserGroupCookie=GENERAL; dtCookie=556C79745BE371ADA9D6DC4F3A8DEEE2; dtApps=|AxisDirect+Portal|1; dtSa=true|click|click%20on%20%22search-button%22|1338285414540|G_1338285410542||Online%20Share%20Trading%20India%20%7C%20Stock%20Brokers%20%7C%20Axis%20Direct; dtPC=G_1338285403511#load; dtLatC=40|43|43|109.5|-47|43.5|109.5|-31|43|107|-17; dtLatCT=1338285221215|6|-22; ObSSOCookie=PqclsbkSCIVpkTqbl9yFHtLX4HJmX8iJzNhC5L+cmF1qp61xGsXy1lcByN5ebysN0nu0F4HtzF1yT+hyR3Pv80zr+X0Ctk4BVzJ6yEuE2jGlKEzYtLSFOgw0mgGX4Db8HK/IDKvIXkXpdSj5DHAHodvJT4qiXIQE/BF8k1roX6kTQrwPm2qclr3pFxU/WRiwV0IYVWkSscNFTEGMXB+Y94GAvJmGDQsNKadJ1NVbnmzku5sID9E72GQ566JAuQcFKGJ52Xee854Rs24yFGik7PGswD2ZN5gcCuuIZqHziD+ePFnsDFHoHtNTdbZe8W+S+J29XHgeJCH++zpIaBRV0Q=="

    Please Suggest.

    1. Hi Amol

      Seems you try to get the UEM Action Name from the dynaTrace UEM Cookie - correct? There already is a measure type under "User Experience Management -> Business Transaction Eval/Filter/Grouping -> Page Actions - Name". This measure will return the name of the Page Action. You can then use this as split measure in your BT.

      If this is what you want please use this measure type instead of trying to extract this information from the Cookie


      1. Hi Andreas,

        Thanks for reply,but I want to extract information from Server side response rather than using EUM,Also I

        want clarification from on other issue like in my WebRequest in Query I m getting "Query:
        terminal=ITS&jspName=Default&baseReqProcessor=auth&lang=E&instClass=EQUITY&securityID=INE043D01016&accNum=205618&compName=I%20D%20F%20C" this part I want to extract components like Comp Name,securityID etc.How I can get this done

        As I'm not getting measure which will return me strings from query.

        Please suggest.

        1. Hi Amol

          Please post this question again on the Forum and I will explain how you can capture these query parameters and how to use them in Business Transactions


  2. Can any body give me idea about how I can use multiple expression in regex

    like I have query


    I Have to check for condition for PageLabel and WindowLabel in single expression

    Please suggest.

    1. Hi Amol

      Can you ask this question in the Q&A Forum instead of this page. More people will see it on the forum and I am sure there are some RegEx Experts out there that will help you


  3. We recently had an engagement where we had troubles with regular expressions. We found the ones below helped so I'm including them here.
    The prospect also wanted me to promote how valuable this link is in getting the proper format for regular expressions as used by dynaTrace.

    For grabbing data from an XML as in the following pattern

    ...tions>                   <Dates>          <DatePeriod Option="LastMonth"/>              </Dates>             <Opt...

    The following Regex works:


    The result = <DatePeriod Option="LastMonth"/>

    For grabbing data from an XML as in the following pattern

    ...lean:false} RequestMetaData_Client={String:BobDobbs} RequestMetaData_Univer...

    The following Regex works:


    The result = BobDobbs

  4. Hi,
    how can I get the length of a string with transformation regex?
    I want to get an argument's length while creating a new measure.

  5. This is a good one to capture a value with a space,  \bSubscriberid:\s*([0-9]+)\b

  6. A suggestion


    should be changed to this to be able to match zero or more characters

  7. Hi,


    Can anyone please assist me with a regex to extract up to the first 2 parts of a URI?

    Please see below examples of what it needs to be able to do














    1. Try this : /([^(/;\?)]*/)([^(/;\?)]*).*

      1. Thanks Andreas I have previously tried this expression but could not get it to also work for URI's that only consist of 1 part.

        for example it does not work for a URI like this:


        It only works for URI's that have at least 2 parts like this:



        So i need it to take both cases into account and return only up untill the 2nd part so anything after the 2nd part needs to be discarded.


        Thanks for looking into this.



        1. Quite late; make the secondpart optional :


          Tested with









          Matches all of the above.

  8. Got an interesting use case which I am unsure of how to handle.

    Basically, I need to build a BT that splits on two types of transactions.  Those with GUIDS at the end of the URL and those which don't.  Important to note, I do not care about the GUID and I don't want to split on it.  I just want to split on the presence vs absence of the GUID.




    How can this be done? (I'm fine transforming the guid to something common such as the word with_guid at the end of the URL), can this be done within the transformation regex?

    Also, the number of paths can vary form 3-6 in length.  e.g. domain/path1/path2/path3/guid or domain/path1/path2/path3/path4/path5/guid

    The regex I wanted to use isn't liked by dynaTrace.  I've played around with several variants to no avail.

    E.g.  (?P<URL>[]!"#$%&'()*+,./0-9:;<=>?@A-Z[\\_`a-z{|}~^-]+)[0-9a-f-]{36}

    If I was doing this in Python, I'd do something like:

    result = re.sub(r"""(?P<URL>[]!"#$%&'()*+,./0-9:;<=>?@A-Z[\\_`a-z{|}~^-]+)[0-9a-f-]{36}""", r"\g<URL>with_guid", subject)




    1. Colin,

      Is it okay if you create 2 BTs: 1 with GUID and the other w/o GUID? If it is okay, then you can create the first BT with a filter that looks for a GUID and the other one does not look for GUID.

      1. yea, would really prefer it to be in one BT if possible.  I went down this road and had numerous BT measures for different sites.. Trying to do some housekeeping and cleanup and consolidate what is there.

    2. Regex for GUID (Assuming GUID is valid format with 36 character hexadecimal chars & -) : [0-9a-f-]{36}

      Regex to match /a1/a2/a3/a4/a5/a6/  :  ^/((?:[a-zA-Z0-9]+/){1,6})$

      Regex to match /a1/a2/a3/a4/a5/a6/GUID :  ^/((?:[a-zA-Z0-9]+/){1,6}[0-9a-f-]{36})$


      However this will create many splits if GUID keeps changing.

      But as you said if first few parts of GUID remains like: 1841b1c0-b44f-4468-bf07-xxxxxxxxxxxx

      then modified GUID regex : 1841b1c0-b44f-4468-bf07-[0-9a-f-]{12}



       Should match something like :  /datasvc/v1/overview/client/1841b1c0-b44f-4468-bf07-222222222222

      and would return only /datasvc/v1/overview/client/1841b1c0-b44f-4468-bf07-


      Combined regex would be:


       Tested with

  9. Use this to get the 4th part of the URI,


  10. Is there a way to add a space into a regex? 

    Here is what i want to do:

    I am baselining 15 different URIs that all follow this pattern:


    I am splitting these requests by the different "Example###" URIs.  I can get it so the results look like the following:




    I would like to insert a space in between "Example" and the number in the URI so the splittings would look like this:

    Example 2
    Example 34
    Example 567 

    Is there a way to do this?

    1. Won't the regex:



      I can't test it here, not sure if Dynatrace will report both groups or only one of them, regex tester does not complain

  11. Hi,

    We have on our website URL like  <host>/pt-pt/<path>   or   <host>/en-US/<path>

    I want BT to homepage website. As I explain my website have 2 languages PT-PT and EN-US so for this BT I want to split by language so I create BT spliting measure using sugested regex of

    First Part of URI Path:    /([^(/;\?)]*).*

    The problem is that I have more splits then i want because pt-PT and as an example pt-pt are different.

    There is some way of  make "/([^(/;\?)]*).*" always extract lowercase?




    1. Try:


      But I think manipulation of original string using regex is not possible.

  12. 1. Capture Any Client IPv4 Except List of IP Address:


    Any IP except: or or


    Here, enlist IP addresses and escape dots by \


    2.Capture Any 3-digit code except 000



    3. Capture the nth part out of text delimited by some character sequence:

    e.g: Return Value:

    [null, 3333332, 0000000000000000, 556565, null, null, null, null, 20150813Text, null,..

     to capture 20150813Text which is after 8th comma :

    Regex: (?:[^,]*?,){8}([^,]*?),


  13. I am trying to remove numbers throughout the URI to avoid a split explosion.  the patterns that I have seen come across are:



    etc.  The number could appear anywhere in the URI.  can anyone think of a transformation Regex which will remove numbers from the URI?

  14. It's quite simple but should address your need


    Please bear in mind that it may fail in case of URIs containing digits like /fooRequestEnd2End/1234/documentation/


    1. thanks Janusz.  if you don't mind, can you explain how it works.  I know that \D is non-digit and \d is digit, I just want to understand regex better.


        (\/\D+) is capturing and reporting everything starting with / until first digit is met (e.g. /fooRequest/ )

        [\/\d]* then - if any combination of / or digits is met - will be captured but ignored (e.g. 1234/ )

        (\D*) and finally - if any non-digits are met - there are captured and reported (e.g. documentation/ )


        Also - take a look at - enter the regex with your examples and pretty good explanation is provided there.

    2. Can you suggest expression that does not selects any number in URI, but selects only non-numeric characters? It will be helpful.

      1. No replacement is possible from what I know so maybe something generic like



  15. I need regex for below highlighted cookie.

    Cookie: JSESSIONID=3w9Ye7cPu3PiYmjZ-6VdsgZ0wd.kvq4j5wr1;
    s_stc=%5B%5B%27EMRO812490%27%2C%271452569264366%27%5D%2C%5B%27BARO987920%27%2C%271452680799526%27%5D%2C%5B%27EMRO812490%27%2C%271452790573219%27%5D%5D;s_schan=%5B%5B%27Email%27%2C%2714525659264368%27%5D%2C%5B%27Banner%27%2C%2714526807995527%27%5D%2C%5B%27Email%27%2C%27145279057433220%27%5D%5D; campaigntracking=EMRO8162490#; s_nr=1452517339152; s_cc=true; c_m=undefinedDirect%20LoadDirect%20Load; s_sq=%5B%5BB%5D%5D; MEMBERNAME=Flin; BIGipServerqmiles-qrcom-http=2718400.20736.0000; s_dl=1;
    testtesttest=512692623; cpm_token=20407541452836493242; __session:0.00453439676758:=https:

    1. Hi Ram, try testtesttest=([0-9]+);

      1. Thanks Adam its working (smile) 

        By the way I should get only the value 512692623. & now and i am getting testtesttest=512692623; entire?

      2. I'd suggest \btesttesttest=([0-9]+) in case this parameter is last one and not proceeded by ; and not to capture someothertesttesttest=512692623

        1. Hi Janusz, how are you ?

          We have the problem, I built a Measure the type "Method Argument Value" for use in a Split field of a Business Transaction and I'd like that say "Channel: " + {channelNumber} and not only de {channelNumber}. Can do it in 6.2 or 6.5 versions ??

          1. Damian

            Can you paste the full value of the method argument and tell us what you want to extract from it?

          2. Damian, I think there is no functionality to transform/modify strings with regular expressions for measures. 

            I think answer provided by Andi on community pages you saw is still valid.

  16. Also need regex to get ip address for X-Forwarded-For:


    Pragma: no-cache
    Cache-Control: no-cache, max-age=0
    Connection: keep-alive

    1. X-Forwarded-For:\s*(\d+\.\d+\.\d+\.\d+)

      1. Thanks Janusz

        Its working fine (smile).

  17. We have a situation where the web service URL that is tracked in dynatrace shows up as follows -





    Now, in the BT, if I create a filter measure where URI contains /webservice/, it just filters one of the above services. Do I need to create 3 filter measures to match each of the above because the contains construct is case sensitive as per DT documentation (RegEx - Using Regular Expressions)

    Is there a way in which I can use Regex to flag a case insensitive comparison.


    1. How about pretty graceless Regex like this ?  \/[wW][eE][bB][sS][eE][rR][vV][iI][cE][eE]\/

      1. Thanks, Janusz.

        Although inelegant, it served the purpose.

      2. Would like to know if dynatrace regex engine supports turning on/off of case in regex itself?



        1. Woow, just checked it - it does!

  18. Maybe someone can help me with a regex to capture all requests from these set of client IPs.  I've been able to get the first two but can't seem to get the third included.



    This was my first attempt that captured the first two:  111.222.8[5,9].3[0-8]




    1. Hi Dan, try 


      (BTW: if somebody wants to use this as future reference e.g. for ranges -;; please use following Regex:


      so e.g. IP address is not captured)

      1. Thank you very much.  That one does work.

  19. Try this:


    1. Thanks so much for your reply, but that one does not seem to work.  I have used the one from Janusz so I am good for now, but I do appreciate your response.



  20. Dear All,

    Is there a way to say to the regular expression it should match only to urls that does not contain .gif|.png|.jpg|.css|.css?

    I am trying below this fails, because it does not allow the seperate characters g i and f. I only want it to fail when it is the exact string gif.


    Kind regards,


    1. Hi Mark,

      [] is character class, try Not Regex with https://(.*)/.+?(\.gif|\.jpg|\.png|\.css)$

      There is already one good regular expression in inbuilt web request measure named :No Image Request. You can find it in measures or Business Transactions -> Inbuilt -> Web Request -> Splitting -> No Image request.

      You can try that if it works for you.(I'll post that soon.)

      Thanks & Regards,


      1. Hello Rajesh,

        To be honest I am searching the regular expression for DCRUM and not for Application Monitoring, it is not possible to select Not Regex. Therefore the Regex should include the not.

        Kind regards,


        1. Hi Mark,

          Try this and let know if it works for you:


          1. Hello Rajesh,

            In the RUM Console it complains that it is not a valid regular expression, due to the question mark. The error message states "an attempt to repeat something that can not be repeated at position 13"


            If I leave it out it will not work. If I place a \ in front of it it does not work either. Any ideas how we can avoid the use of a question mark?

            Kind regards,


            1. Rajesh Swarnkar, your idea is great ;)


              Mark, try this below (fill fail most likely)


              you may encountering  fact that basic posix notation may not be able to handle this, try this instead 


              Please mind this has no capturing group defined, you need to define what is to be captured e.g.



              1. Hello Janusz,

                DCRUM Regular expression is limited. It does not allow ? and { therefore all three regular expressions does not work.

                However I think I have a workaround for it. I can enter multiple URL Monitor rules. So the first will monitor all urls that does  not contain a . at the end.


                Then a second URL Monitor will monitor all urls that have the extension .properties, .cur and .html


                This way I monitor all the urls except the .gif, .js, .css, png, and .jpg

                Kind regards,


                1. Dear Janusz,

                  Thank you for pointing out that the RUM Console might not be able to process complex regular expressions. On the AMD the second regular expression works for most components, except for the javascript .js it still says match. See output below from the AMD:


                  >$ regex ext  "${perl}##(https?:\/\/.+$(?<!\.gif|\.js|\.png|\.css|\.ico|\.jpg))" "https://sap/public/icmandir/its/ls/js/html/browserhistory.js"




                  Can also explain why. Apparently it decides on the first exclude how long this string should be. .gif is 4 characters long, therefore it expects the other exclude also 4 characters long. Except .js is only 3 characters long. It will say match. If I place the .js on the location where .gif resides, then .js is not matched but the others are.

                  Any idea how to solve this?

                  Kind regards,



                  1. I dont understand why - your explanation is not justified with Regex logic I know (maybe some bug ?) -  but did you try this order then ?


                    1. Yes I tried that order. What happens is that:

                      • .js is not matched
                      • .gif matched
                      • .jpg matched
                      • .png matched
                      • .css matched
                      • .ico matched

                      That is the reason I thought it was reason of the size.

                      Kind regards,


                      1. Force analysing some one more character then by using



                        1. Dear Janusz,

                          Thank you the AMD Regex tester shows it now correctly. I will test it tomorrow by publishing the configuration to the amd and see if it is able to use the super great regex.

                          Found on the Internet an explanation why it failed:

                          That look-behind requires a fixed-width pattern, however smarter regex libs will allow an alternation with varying lengths for the alternatives (and use the longest), as long as each alternative is of fixed length.

                          Kind regards,


  21. Displaying(formatting) comma separated currency value as space separated values:

    I have currency number formats like: 12,600  or 999,999 or 1,222,3445,455  and so on. 

    I am aware that dynatrace regex engine can display the matched group by single space for each matching group. 

    One of the client wants to format these currency numbers(coming in return value of some method) as space separated (However strange its requirement by client).

    Thus it should become '12 600' or '999 999' or '1 222 3445 455' and so on.


    If the currency value has definite number of digit limit(say 12), I would have simply appended 12-regexes by OR-ing. But that is not the case.

    My best try was: 


    Please suggest If you can nail out some solution. (smile)


    1. Hi Rajesh,

      How about something like


      If decimal fraction may also be added you can also add something like this:


      Or, even more generic





  22. Hello All,

    I need to capture the 4th part i.e 5100A1BZ in the following text:

    some, test, value, 5100A1BZ, d88958, 6795607, 4569xk945, 6908456idfgk, 9568dgfkn, other text values, and so on

    I am trying this:


    But this is unexpectedly capturing 


    I think I am doing something wrong. Any help is appreciated.


    1. Hi Rajesh,

      I think you should use non-capturing group in first part of your regex, like (?:[^,]*,){3}

      Then just capture what you want to get. ([^,]*)

      Final ,.* is not required


      1. Great Janusz. Look around was unnecessary.

        Also, I was wondering the solution if the Delimiter were sequence of multiple chars instead of single character.

        E.g. In below text:

        text #$ some other text #$ interesting part 101#$ some others #$ and so on

         Here #$ is delimiter sequence and if one wishes to extract the 3rd field.


        My guess:

        1. Rajesh, I think your guess correct. This is very good usage of lazy * qualifier.

          Only note - this is pretty CPU-consuming regex (due to backtracking) so for single-character delimiter it's more recommended to use negated character.

          1. Thanks Janusz. Surely will take care of not applying this to high call rate BT/M.

            I think, one will be forced to use the look around as negation class does not support sequence negation. (smile)

  23. N-th element text in a structured document like XML (or JSON?) having multiple occurrences in text:

    I faced a requirement where it needed to capture the some text part of first xml element in argument value.
    It could have been simple if only the element was non repeating further in the text and the surrounding text were to be unique. 

    Is there any regex to select n-th text part is such case? 


        ...<!-- some other structures-->

    For first element my try is: 


    And this works well for Transformation Regex.

    1. Something like below ?



      1. Thanks Janusz. That should help.

        (Side Note: I realized why XPath was required.)

        1. Great if it helps, but please keep in mind parsing XML with REGEX is tough and often not possible as was discussed many times on different forums already.


          1. Yes, that is a big overhead for a measure with high-moderate call rates and should be avoided.

            (Here is a humorous post on SO.)

  24. Are conditionals allowed in regex in Dynatrace? If so, are they overly CPU consuming to the point where they should not be used?

    I ask because I am running into an issue consistently capturing a chunk of a URI because the target piece of the URI sometimes shifts. Here is an example:

    The URI can come in two different flavors, with my target boldened:

    • /grabme/extra/stuff/idonotneed
    • /baneofmyexistence/grabme/extra/stuff/idonotneed


    Is there a way to do this without conditionals? Have I just been looking at this too long?

    Any help would be greatly appreciated!

    • Kasey C.





    1. Kasey

      Try this:


      1. Hi Asad,

        Thank you very much for your suggestion! I suppose I had been looking at the URIs too long. I had been so focused on the frontend of the URI being variable that I did not think of using the latter portion of the URI to isolate what it was that I wanted to target!

        I greatly appreciate your help! Thanks again!

        • Kasey C.


  25. This might be more directed to the lab and the DEV folks, but is there a practical way of checking the "cost" of a particular RegEx?

    I just know that some are very CPU intense and others are not, but I don't know why.

    1. Ulf,

      To understand "why" see two resources for the beginning - where I tried to explain why one regex is more "processing - expensive" than another and also I'd like to recommend very good tutorial that explains how to take most of Regex - see - Tutorial, please take note on this chapter where author explains how Regex engine actually works. For me it was a good introduction. This helped me to answers questions like this (smile)

      To see how costly Regex is and how it works I'm using checker and tester.

      1. Yeah - I agree - those are really good and I use that and a few others too.

        But maybe I didn't explain thourgly enough - my bad!

        What I was looking for is somekind of log that tells me what is costly when it comes to config, whether you use RegEx or some other method. I.E what SS's are the costlyies and what pieces in those SS's are the ones costing?

        1. Ulf, I think RFE like this for AppMon was already submitted. I wonder if this is available in DC-RUM, interesting. I think answers community forum might be a better place to ask this question, I wonder if this page is followed by Devs or DC-RUM PMs (maybe I'll be surprised (smile) ). Anyway I'm following your question.

          1. Aaah - didn't see that one - but now it has my vote. We've seen some nasty stuff in our biggest account so it's badly needed in AppMon.

            This is also the reason why I'm curious if there is an easy way in DCRUM to spot these "nasty little hobbits" (smile)

  26. Hello Janusz Dabrowski

    kindly help me with regex for below URI pattern.


    Value: /zh/search/api/guidedparametric/ATVds930

    I want match for /search/api/guidedparametric/


    kindly note: "/zh" and "/ATVds930" will always change





    1. Hi Ram. Depending on what you want to achieve, only see if '/search/api/guidedparametric/' is present ? Then just


      should be fine. Do you want to capture and return '/search/api/guidedparametric/' ? then try


      Do you want to report entire URI ? try


      Use regex tester like this one to see if your regex meets your need

      I hope this helps.

      1. Hello Janusz,

        Yes, I want to capture and return '/search/api/guidedparametric/'

        regex : (\/search\/api\/guidedparametric\/) is working fine in but not in dynatrace. Testing regular expression "No Pattern match found"

        1. This is for AppMon measure ? Try


          in case you want to use '/search/api/guidedparametric/' as capturing group

          1. Janusz Dabrowski no its not working as expected.



          2. Hi Janusz, I am not sure if /'s are meta characters in DT? Is escape necessary?

    2. How about you use a measure with web request URI contains the common url string? (I assume that you are using AppMon and not DCRUM, And urls are exclusive and not part of different multiple url patterns.).

      Also could you post the full screenshot of your measure?