Working regex elsewhere does not work in Splunk

mxanareckless — Thu, 11 Mar 2021 00:24:18 GMT

As seen in the first example, the expression I've constructed will capture the field values I want. However in the second example, all of the values are not being captured for the field I wish to extract. Why is it capturing everything in the first example, but not the second?

Capturing between 1-3 digits followed by 1 of any letter.

Re: Working regex elsewhere does not work in Splunk

richgalloway — Thu, 11 Mar 2021 14:40:45 GMT

Try a variation of the regex.

(?<size>\d{1,3}\w)

topic Re: Working regex elsewhere does not work in Splunk in Splunk Search

Working regex elsewhere does not work in Splunk

Re: Working regex elsewhere does not work in Splunk