<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Regex Help in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568333#M100872</link>
    <description>&lt;P&gt;you mean transforms.conf ?&lt;/P&gt;&lt;P&gt;Below are the two regex's i tried&lt;BR /&gt;&lt;BR /&gt;[email-anonymizer]&lt;BR /&gt;REGEX = (^.*[^.]+)(^.*[^.]+)(?ms)(\"emailAddress\")(.*)&lt;BR /&gt;FORMAT = $1$2$3########&lt;BR /&gt;DEST_KEY = _raw&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;[ss-email-anonymizer]&lt;BR /&gt;REGEX = (^.*[^.]+)("[A-z0-9._%+-]+@[A-z0-9.-]+\.[A-z]{2,63}),\s*([A-z0-9._%+-]+@[A-z0-9.-]+\.[A-z]{2,63}")(\s.*[^.]+)&lt;BR /&gt;FORMAT = $1###########$4&lt;BR /&gt;DEST_KEY = _raw&lt;/P&gt;</description>
    <pubDate>Fri, 24 Sep 2021 06:47:45 GMT</pubDate>
    <dc:creator>SS1</dc:creator>
    <dc:date>2021-09-24T06:47:45Z</dc:date>
    <item>
      <title>Regex Help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568318#M100869</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;I have the below log entry, can you help with the regex to extract the line in Red. The regex i have is not working properly in props.conf&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;2021-09-23 19:03:40.802 INFO 1 --- [sdgfsdgsdfgsdfg] asdfasdfasdfasfasfgfdhdfhdf : Response --&amp;gt; {&lt;BR /&gt;"claimId" : asfdasdfadf,&lt;BR /&gt;"claimFilerId" : "sadfasdf",&lt;BR /&gt;"vendorName" : "asfasfadfadf. ",&lt;BR /&gt;"vendorId" : "aefadf",&lt;BR /&gt;"vendorAddressId" : "asfafsd",&lt;BR /&gt;"vendorAddress" : "sdfgsdgsfg",&lt;BR /&gt;"preparedDate" : "09-22-2021",&lt;BR /&gt;"receivedDate" : "09-22-2021",&lt;BR /&gt;"enteredDate" : "09-22-2021",&lt;BR /&gt;"assignedTo" : {&lt;BR /&gt;"employeeId" : "sdfasdf ",&lt;BR /&gt;"firstName" : "asfasf",&lt;BR /&gt;"lastName" : "zsdfdf",&lt;BR /&gt;"adUserIdentifier" : "zsdfvzdv"&lt;BR /&gt;},&lt;BR /&gt;"correspondence" : {&lt;BR /&gt;"type" : {&lt;BR /&gt;"code" : 5947,&lt;BR /&gt;"shortName" : "EOB",&lt;BR /&gt;"longName" : "EOB"&lt;BR /&gt;},&lt;BR /&gt;"dispatchCode" : {&lt;BR /&gt;"code" : 5947,&lt;BR /&gt;"shortName" : "NtRqd",&lt;BR /&gt;"longName" : "Not Required"&lt;BR /&gt;},&lt;BR /&gt;&lt;STRONG&gt;&lt;FONT color="#FF0000"&gt;"emailAddress" : "abcd@g.com,&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;dgfh@a.in"&lt;/FONT&gt;&lt;/STRONG&gt;&lt;BR /&gt;}&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 02:21:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568318#M100869</guid>
      <dc:creator>SS1</dc:creator>
      <dc:date>2021-09-24T02:21:34Z</dc:date>
    </item>
    <item>
      <title>Re: Regex Help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568330#M100870</link>
      <description>&lt;P&gt;What regex do you have in props.conf?&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 06:36:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568330#M100870</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-09-24T06:36:19Z</dc:date>
    </item>
    <item>
      <title>Re: Regex Help</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568333#M100872</link>
      <description>&lt;P&gt;you mean transforms.conf ?&lt;/P&gt;&lt;P&gt;Below are the two regex's i tried&lt;BR /&gt;&lt;BR /&gt;[email-anonymizer]&lt;BR /&gt;REGEX = (^.*[^.]+)(^.*[^.]+)(?ms)(\"emailAddress\")(.*)&lt;BR /&gt;FORMAT = $1$2$3########&lt;BR /&gt;DEST_KEY = _raw&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;[ss-email-anonymizer]&lt;BR /&gt;REGEX = (^.*[^.]+)("[A-z0-9._%+-]+@[A-z0-9.-]+\.[A-z]{2,63}),\s*([A-z0-9._%+-]+@[A-z0-9.-]+\.[A-z]{2,63}")(\s.*[^.]+)&lt;BR /&gt;FORMAT = $1###########$4&lt;BR /&gt;DEST_KEY = _raw&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 06:47:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Regex-Help/m-p/568333#M100872</guid>
      <dc:creator>SS1</dc:creator>
      <dc:date>2021-09-24T06:47:45Z</dc:date>
    </item>
  </channel>
</rss>

