<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: regex to capture both fields as below in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557408#M92259</link>
    <description>&lt;P&gt;Often helps to be clearer&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":grinning_face:"&gt;😀&lt;/span&gt; Will this work?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex "\"category\":\".*?(?&amp;lt;string&amp;gt;[^\-\"]+)\""&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Mon, 28 Jun 2021 11:18:07 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-06-28T11:18:07Z</dc:date>
    <item>
      <title>regex to capture both fields as below</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557397#M92256</link>
      <description>&lt;P&gt;Hi SMEs,&lt;/P&gt;&lt;P&gt;Seeking help to capture below 2 strings (Only string1 &amp;amp; Only string1) as below in one regex&lt;/P&gt;&lt;P&gt;","category":"Only string1",&lt;/P&gt;&lt;P&gt;","category":"a1b2c3-Only string2",&lt;/P&gt;</description>
      <pubDate>Mon, 28 Jun 2021 10:33:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557397#M92256</guid>
      <dc:creator>pavanbmishra</dc:creator>
      <dc:date>2021-06-28T10:33:27Z</dc:date>
    </item>
    <item>
      <title>Re: regex to capture both fields as below</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557400#M92257</link>
      <description>&lt;LI-CODE lang="markup"&gt;| rex "\"category\":\".*(?&amp;lt;string&amp;gt;Only string\d)\""&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 28 Jun 2021 10:49:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557400#M92257</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-28T10:49:45Z</dc:date>
    </item>
    <item>
      <title>Re: regex to capture both fields as below</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557406#M92258</link>
      <description>&lt;P&gt;Let me be more clear here&lt;/P&gt;&lt;P&gt;","category":"thisissomethingineedtocapture",&lt;/P&gt;&lt;P&gt;","category":"a1b2c3-thisissomethingialsoneedtocapture",&lt;/P&gt;&lt;P&gt;Here thisissomethinginnedtocapture &amp;amp; thisissomethingialsoneedtocapture should come in regex value. These both are strings and doesn't have any numeric value.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Jun 2021 11:06:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557406#M92258</guid>
      <dc:creator>pavanbmishra</dc:creator>
      <dc:date>2021-06-28T11:06:10Z</dc:date>
    </item>
    <item>
      <title>Re: regex to capture both fields as below</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557408#M92259</link>
      <description>&lt;P&gt;Often helps to be clearer&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":grinning_face:"&gt;😀&lt;/span&gt; Will this work?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex "\"category\":\".*?(?&amp;lt;string&amp;gt;[^\-\"]+)\""&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 28 Jun 2021 11:18:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557408#M92259</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-28T11:18:07Z</dc:date>
    </item>
    <item>
      <title>Re: regex to capture both fields as below</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557409#M92260</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/196109"&gt;@pavanbmishra&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you please try this?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;YOUR_SEARCH
 | rex field=_raw "\"category\":\"(.*\-)?(?&amp;lt;category&amp;gt;.*)\""&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;My Sample Search :&lt;/STRONG&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval raw="\",\"category\":\"thisissomethingineedtocapture\",|\",\"category\":\"a1b2c3-thisissomethingialsoneedtocapture\",|\",\"category\":\"Only string1\",|\",\"category\":\"a1b2c3-Only string2\"," | eval raw=split(raw,"|")|mvexpand raw | rename raw as _raw
| rename comment as "Upto Now is sample data only" | rex field=_raw "\"category\":\"(.*\-)?(?&amp;lt;category&amp;gt;.*)\""&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;&amp;nbsp;Thanks&lt;BR /&gt;KV&lt;BR /&gt;▄︻̷̿┻̿═━一&lt;BR /&gt;&lt;BR /&gt;If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Jun 2021 11:26:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/regex-to-capture-both-fields-as-below/m-p/557409#M92260</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-06-28T11:26:49Z</dc:date>
    </item>
  </channel>
</rss>

