<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: regex help to split into two rows of data in Deployment Architecture</title>
    <link>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/679010#M27939</link>
    <description>&lt;P&gt;thanks that did it. thank you&lt;/P&gt;</description>
    <pubDate>Wed, 28 Feb 2024 15:06:18 GMT</pubDate>
    <dc:creator>thaghost99</dc:creator>
    <dc:date>2024-02-28T15:06:18Z</dc:date>
    <item>
      <title>regex help to split into two rows of data</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/678868#M27934</link>
      <description>&lt;P&gt;here is the current data&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Feb 27 14:12:38&lt;BR /&gt;node0:&lt;BR /&gt;--------------------------------------------------------------------------&lt;/P&gt;&lt;P&gt;Attack database version:3670(Thu Feb 22 14:12:38 2024 UTC)&lt;BR /&gt;Detector version :12.2.140230313&lt;BR /&gt;Policy template version :3535&lt;/P&gt;&lt;P&gt;node1:&lt;BR /&gt;--------------------------------------------------------------------------&lt;/P&gt;&lt;P&gt;Attack database version:3670(Thu Feb 22 14:12:38 2024 UTC)&lt;BR /&gt;Detector version :12.2.140230313&lt;BR /&gt;Policy template version :3535&lt;/P&gt;&lt;P&gt;{primary:node0}&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;i need help extracting the values for attack version (just the digit), detector version and policy template version, by node (ie: node 0 and node 1)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;output looks like something like this&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Node&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Attack database version&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Detector version&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;&amp;nbsp;Policy template version&lt;/P&gt;&lt;P&gt;node0&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;3670&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;12.2.140230313&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;3535&lt;/P&gt;&lt;P&gt;node1&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;3670&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;12.2.140230313&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;3535&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;please and thank you, i am only able to get the node0 but not node1 &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 27 Feb 2024 16:18:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/678868#M27934</guid>
      <dc:creator>thaghost99</dc:creator>
      <dc:date>2024-02-27T16:18:29Z</dc:date>
    </item>
    <item>
      <title>Re: regex help to split into two rows of data</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/678885#M27935</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224479"&gt;@thaghost99&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;please try this regex:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex "(?ms)(?&amp;lt;node&amp;gt;node\d+).*?Attack database version:(?&amp;lt;Attack_database_version&amp;gt;\d+).*?Detector version\s*:(?&amp;lt;Detector_version&amp;gt;[^\n]+).*?Policy template version\s*:(?&amp;lt;Policy_template_version&amp;gt;\d+)"&lt;/LI-CODE&gt;&lt;P&gt;that you can test at&amp;nbsp;&lt;A href="https://regex101.com/r/R9SWnM/1" target="_blank"&gt;https://regex101.com/r/R9SWnM/1&lt;/A&gt;&lt;/P&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Tue, 27 Feb 2024 17:35:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/678885#M27935</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2024-02-27T17:35:37Z</dc:date>
    </item>
    <item>
      <title>Re: regex help to split into two rows of data</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/679010#M27939</link>
      <description>&lt;P&gt;thanks that did it. thank you&lt;/P&gt;</description>
      <pubDate>Wed, 28 Feb 2024 15:06:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/regex-help-to-split-into-two-rows-of-data/m-p/679010#M27939</guid>
      <dc:creator>thaghost99</dc:creator>
      <dc:date>2024-02-28T15:06:18Z</dc:date>
    </item>
  </channel>
</rss>

