https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40847#M178910 <P>I saw regex for windows in tutorial, thank you!</P> Mon, 04 Jun 2012 12:37:18 GMT melonman 2012-06-04T12:37:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40845#M178908 <P>Hi</P> <P>I was trying to go thru Splunk Tutorial, but now I am having trouble in getting sampledata.zip indexed using the host regex shown in the Splunk Tutorial page. My Splunk is on Windows.</P> <PRE><CODE>Sampledata.zip:./([^/]+)/ </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/User/Adddatatutorial">http://docs.splunk.com/Documentation/Splunk/latest/User/Adddatatutorial</A></P> <P>Is this regex good for Windows Splunk?</P> <P>Thanks,</P> Wed, 02 May 2012 01:25:31 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40845#M178908 melonman 2012-05-02T01:25:31Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40846#M178909 <P>No as path where it will be extracted will be <CODE>\</CODE> rather than <CODE>/</CODE> then try :</P> <PRE><CODE>Sampledata\.zip:.\\([^\\]+)\\ </CODE></PRE> Wed, 02 May 2012 07:29:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40846#M178909 MarioM 2012-05-02T07:29:47Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40847#M178910 <P>I saw regex for windows in tutorial, thank you!</P> Mon, 04 Jun 2012 12:37:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40847#M178910 melonman 2012-06-04T12:37:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40848#M178911 <P>Well, the regex in tutorial is not working.</P> Mon, 25 Jun 2012 13:40:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40848#M178911 melonman 2012-06-25T13:40:47Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40849#M178912 <P>In 4.3.2, I confirmed this is working for both type of OS.</P> <UL> <LI>For Unix OS : Sampledata.zip:./([^/]+)/</LI> <LI>For Windows ： Sampledata.zip:.\\([^/]+)/</LI> </UL> <P>** The regex in Tutorial Doc is not working, be careful.</P> Mon, 25 Jun 2012 14:11:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Sampledata-zip-indexed-into-Windows-based-Splunk/m-p/40849#M178912 melonman 2012-06-25T14:11:21Z