topic Re: Rexgex Non-capturing group - still capturing in Splunk Search

Rexgex Non-capturing group - still capturing?

tb5821 — Mon, 13 Feb 2023 16:48:00 GMT

rex field=title "(?titleNEW(.*?)(?:-))"

I have this rex command above but it still outputs the dash at the end which is in a non-capturing group- any help?

tb5821 — Mon, 31 Jul 2017 20:47:27 GMT

Figured this out - by changing where the new field name paranthesie was...

rex field=title "(?<titleNEW>(.*?))(?:-)"

jotne — Sat, 11 Feb 2023 10:29:12 GMT

Not sure if you have an optimal regex. Why do you make a non capturing group of "-" and why a capture group in the named group? This is some better:

rex field=title "(?<titleNEW>.*?):-"

Even better, do not use * in regex when its not needed. Do a search until you find some that its not included, like this:

rex field=title "(?<titleNEW>[^-]+)"