topic Re: regex help in Splunk Search

regex help

desi-indian — Thu, 26 Jan 2012 19:46:28 GMT

I have the following regex which I am using search time extraction..this returns the field I want but I need to tweak it to show/select the filed only If its a "alphabet" i.e It shld omit /Not match number field

(?i)^(?:[^]]*]){5}\s+(?P[^ ]+)

ex :

As a part of the search extraction ..right now I am getting

ABC
222

I need it to match /return only "ABC" not 222

Thanks for any Help!

Re: regex help

imrago — Thu, 26 Jan 2012 22:40:48 GMT

(?i)^(?:[^]]*]){5}s+(?P<fieldname>[a-zA-Z]+)

Re: regex help

desi-indian — Fri, 27 Jan 2012 18:34:50 GMT

Actually tried that (After reading http://forums.asp.net/t/1285485.aspx/1 )but some how Its giving only the numbers ..i.e what I want to eliminate which did not make sense as Its supposed to return only alphabets ... I tried negation "!" too i.e something like [^!A-Za-z] but it did not give me what I want .