topic Field extractions what is the difference between (?P.+) and (?.+)? in Splunk Search

Field extractions what is the difference between (?P.+) and (?.+)?

chris — Mon, 28 Sep 2020 12:23:23 GMT

When I extract Fields from a source/sourcetype through Splunk web using the "Extract Fields" context menu on an event. Splunk seems to generate a regex that conatins an uppercase P before the fieldname. Does anyone know what this does?

Are those equivalent?

(?P<field_name>.+) and (?<field_name>.+)?

Thanks

Chris

Re: Field extractions what is the difference between (?P.+) and (?.+)?

MarioM — Thu, 06 Sep 2012 11:25:21 GMT

i am not sure it does anything special...outside pointing to perl or python:

(?<name>pattern) - Named group (Perl)

(?P<name>pattern) - Named group (Python)

Named groups appears to be a Python-specific extension to regex.

Re: Field extractions what is the difference between (?P.+) and (?.+)?

chris — Thu, 06 Sep 2012 11:38:43 GMT

Makes sense

Re: Field extractions what is the difference between (?P.+) and (?.+)?

jonuwz — Thu, 06 Sep 2012 21:09:42 GMT

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)