<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Parsing text in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66942#M13441</link>
    <description>&lt;P&gt;Thanks Vince - I'll give that a shot.  I knew it couldn't be that complicated - just having a major brain fart...&lt;/P&gt;</description>
    <pubDate>Wed, 20 Mar 2013 12:54:19 GMT</pubDate>
    <dc:creator>mfrederickson</dc:creator>
    <dc:date>2013-03-20T12:54:19Z</dc:date>
    <item>
      <title>Parsing text</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66940#M13439</link>
      <description>&lt;P&gt;I apologize in advance if this question has already been asked and answered.  If it has, I am most likely demonstrating my lack of experience in not knowing what to properly search for.  I am relatively new to regex.  Here is my problem:&lt;/P&gt;

&lt;P&gt;I have several records in my file that contain a three digit number (233, 252, 245, etc.)  In the lines I am concerned about, they always appear between the ampersand:&lt;/P&gt;

&lt;P&gt;&amp;amp; 232 &amp;amp;&lt;/P&gt;

&lt;P&gt;&amp;amp; 252 &amp;amp;&lt;/P&gt;

&lt;P&gt;So it's ampersand, space, three digit number, space and then ampersand.&lt;/P&gt;

&lt;P&gt;How can I extract just the number from the string?  I can't seem to find what I am looking for - I really do better with actual examples.....&lt;/P&gt;

&lt;P&gt;Any assistance would be appreciated.....even if it's pointing me to documentation somewhere (I know RTFM...)&lt;/P&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Wed, 20 Mar 2013 02:40:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66940#M13439</guid>
      <dc:creator>mfrederickson</dc:creator>
      <dc:date>2013-03-20T02:40:45Z</dc:date>
    </item>
    <item>
      <title>Re: Parsing text</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66941#M13440</link>
      <description>&lt;P&gt;Hey mfrederckson,&lt;/P&gt;

&lt;P&gt;This should be pretty straight forward with a regex such as the following:&lt;BR /&gt;
&amp;amp;\s(?P&lt;VALUE&gt;[^ ]+)\s&amp;amp;&lt;/VALUE&gt;&lt;/P&gt;

&lt;P&gt;If you could provide some more information on the actual logs you are searching through, as well as the context of your regex, eg; is it for a props.conf or a search, etc...I would be happy to assist further.&lt;/P&gt;

&lt;P&gt;Regards Vince&lt;/P&gt;</description>
      <pubDate>Wed, 20 Mar 2013 03:13:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66941#M13440</guid>
      <dc:creator>vincesesto</dc:creator>
      <dc:date>2013-03-20T03:13:52Z</dc:date>
    </item>
    <item>
      <title>Re: Parsing text</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66942#M13441</link>
      <description>&lt;P&gt;Thanks Vince - I'll give that a shot.  I knew it couldn't be that complicated - just having a major brain fart...&lt;/P&gt;</description>
      <pubDate>Wed, 20 Mar 2013 12:54:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parsing-text/m-p/66942#M13441</guid>
      <dc:creator>mfrederickson</dc:creator>
      <dc:date>2013-03-20T12:54:19Z</dc:date>
    </item>
  </channel>
</rss>

