https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476116#M192620 <P>Doing an extraction in Splunk Stream and get an error when trying to use (?i) in my regex:</P> <PRE><CODE>(?i)x-forwarded-for([:\s]+[\d\.:\s,]+) </CODE></PRE> <P>Gives this error:</P> <PRE><CODE>Invalid regex Expression </CODE></PRE> <P>This works fine in a rex command, not sure what the Splunk Stream syntax is for case insensitive. Thanks.</P> Thu, 12 Sep 2019 14:33:02 GMT tjago11 2019-09-12T14:33:02Z https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476116#M192620 <P>Doing an extraction in Splunk Stream and get an error when trying to use (?i) in my regex:</P> <PRE><CODE>(?i)x-forwarded-for([:\s]+[\d\.:\s,]+) </CODE></PRE> <P>Gives this error:</P> <PRE><CODE>Invalid regex Expression </CODE></PRE> <P>This works fine in a rex command, not sure what the Splunk Stream syntax is for case insensitive. Thanks.</P> Thu, 12 Sep 2019 14:33:02 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476116#M192620 tjago11 2019-09-12T14:33:02Z https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476117#M192621 <P>Ick, I feel dirty but this works.</P> <PRE><CODE>[xX][-_][fF][oO][rR][wW][aA][rR][dD][eE][dD][-_][fF][oO][rR][:\s]+([\d\.:\s,]+) </CODE></PRE> <P>I'll not accept this answer yet because it feels gross.</P> Thu, 12 Sep 2019 17:10:20 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476117#M192621 tjago11 2019-09-12T17:10:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476118#M192622 <P>Well, I guess the ick answer is better than no answer.</P> Thu, 23 Jan 2020 14:31:27 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Stream-Case-Insensitive-Extraction/m-p/476118#M192622 tjago11 2020-01-23T14:31:27Z