https://community.splunk.com/t5/Splunk-Search/Referencing-extracted-fields-from-regex/m-p/71270#M17815 <P>Yes, if you look in $SPLUNKHOME$/etc/system/default/transforms.conf, you can see many examples of how to do it. Here is one of them:</P> <P><CODE><BR /> [octet] <BR /> this would match only numbers from 0-255 (one octet in an ip)<BR /> REGEX = 2(?:5[0-5]|[0-4][0-9])|[0-1][0-9][0-9]|[0-9][0-9]?</CODE></P> <P>[ipv4]<BR /> matches a valid IPv4 optionally followed by :port_num the octets in the ip would also be validated 0-255 range<BR /> Extracts: ip, port<BR /> REGEX = (?<IP>[[octet]](?:\.[[octet]]){3})(?::[[int:port]])?<BR /> </IP></P> Sun, 10 Jun 2012 02:57:06 GMT richprescott 2012-06-10T02:57:06Z https://community.splunk.com/t5/Splunk-Search/Referencing-extracted-fields-from-regex/m-p/71269#M17814 <P>Hello!</P> <P>How would I go about referencing an already extracted field's regex pattern in a regex?<BR /> So I don't have to copy the pattern of the field each time. </P> <P>For example I have an extracted field for "md5_hash", and I want to look for URLs with the following syntax: "^/some/thing/(md5_hash)". Is this possible?</P> <P>Thanks in advance!</P> Mon, 28 Sep 2020 11:55:24 GMT https://community.splunk.com/t5/Splunk-Search/Referencing-extracted-fields-from-regex/m-p/71269#M17814 balidani 2020-09-28T11:55:24Z https://community.splunk.com/t5/Splunk-Search/Referencing-extracted-fields-from-regex/m-p/71270#M17815 <P>Yes, if you look in $SPLUNKHOME$/etc/system/default/transforms.conf, you can see many examples of how to do it. Here is one of them:</P> <P><CODE><BR /> [octet] <BR /> this would match only numbers from 0-255 (one octet in an ip)<BR /> REGEX = 2(?:5[0-5]|[0-4][0-9])|[0-1][0-9][0-9]|[0-9][0-9]?</CODE></P> <P>[ipv4]<BR /> matches a valid IPv4 optionally followed by :port_num the octets in the ip would also be validated 0-255 range<BR /> Extracts: ip, port<BR /> REGEX = (?<IP>[[octet]](?:\.[[octet]]){3})(?::[[int:port]])?<BR /> </IP></P> Sun, 10 Jun 2012 02:57:06 GMT https://community.splunk.com/t5/Splunk-Search/Referencing-extracted-fields-from-regex/m-p/71270#M17815 richprescott 2012-06-10T02:57:06Z