https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51770#M179615 <P>little d means digit, big D means not a digit. Same with w and W for a letter.</P> Fri, 30 Aug 2013 00:05:28 GMT lukejadamec 2013-08-30T00:05:28Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51766#M179611 <P>I recently came across a Splunk expression, as </P> <P>rex "(?i)\".*? (?P<FIELDNAME>/\w+/((\w+\.\d+)|(\w+\d+))/((\w+/)|(\w+/\w+/)|((\w+/\w+/\w+/)))\D+((\?)|(\s)))\w+" </FIELDNAME></P> <P>and due to the usage of toom many forward and backward slash, I am unable to understand it. Can you please help me in the matter?</P> Thu, 29 Aug 2013 23:37:12 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51766#M179611 Nicksyboy 2013-08-29T23:37:12Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51767#M179612 <P>Pull a fieldname that is followed by a / then one or more letters followed by a /, which will be followed by one of the following:<BR /><BR /> one or more letters followed by a . followed by one or more digits, or<BR /><BR /> one or more letters followed by one or more digits.<BR /><BR /> This will be followed by a / and then one of the following:<BR /><BR /> One or more letters, or<BR /><BR /> One or more letters followed by a / then one or more letters followed by a /, or<BR /><BR /> One or more letters followed by a / then one or more letters followed by a / then one or more letters followed by a /<BR /><BR /> This will be followed by one or more Non-digits.<BR /><BR /> I think that covers all of the /shs.</P> Thu, 29 Aug 2013 23:50:37 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51767#M179612 lukejadamec 2013-08-29T23:50:37Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51768#M179613 <P>Thanks for the quick response! So - \w is for words, \d is for digits. What is D and S stands for?</P> Thu, 29 Aug 2013 23:56:10 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51768#M179613 Nicksyboy 2013-08-29T23:56:10Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51769#M179614 <P>s is any whitespace character.</P> Thu, 29 Aug 2013 23:59:08 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51769#M179614 grijhwani 2013-08-29T23:59:08Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51770#M179615 <P>little d means digit, big D means not a digit. Same with w and W for a letter.</P> Fri, 30 Aug 2013 00:05:28 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51770#M179615 lukejadamec 2013-08-30T00:05:28Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51771#M179616 <P>Thanks guys for your quick response!</P> Fri, 30 Aug 2013 00:12:36 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51771#M179616 Nicksyboy 2013-08-30T00:12:36Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51772#M179617 <P>You are welcome.</P> Fri, 30 Aug 2013 00:14:23 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51772#M179617 lukejadamec 2013-08-30T00:14:23Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51773#M179618 <P>You should accept the answer so others know the issue is closed.</P> Fri, 30 Aug 2013 00:22:42 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51773#M179618 lukejadamec 2013-08-30T00:22:42Z https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51774#M179619 <P>I like this site alot for checking regexes: <A href="http://www.regexper.com/">http://www.regexper.com/</A></P> <P>The regex needed a little modification, but only escaping "/" <BR /> This is the regex I ran to get the site to work:</P> <PRE><CODE>.*? (\/\w+\/((\w+\.\d+)|(\w+\d+))\/((\w+\/)|(\w+\/\w+\/)|((\w+\/\w+\/\w+\/)))\D+((\?)|(\s)))\w+ </CODE></PRE> Fri, 30 Aug 2013 08:58:52 GMT https://community.splunk.com/t5/Splunk-Search/Need-to-understand-the-following-expression/m-p/51774#M179619 gelica 2013-08-30T08:58:52Z