topic What Is Purpose Of Leading P Argument In Field Extraction Regex? in Splunk Search

What Is Purpose Of Leading P Argument In Field Extraction Regex?

psmith3 — Tue, 19 Jun 2012 23:38:24 GMT

When extracting a field using a regex, what does the P argument do (the P character between the question mark and the field name)? I have seen examples with and without this argument, but I don't see any obvious difference in the results. For example:
(?i) Finished (?P.+)
versus
(?i) Finished (?.+)

I looked in the Splunk manual and on the Answers site but couldn't find any description of this argument. Apologies if I'm missing something obvious.

Re: What Is Purpose Of Leading P Argument In Field Extraction Regex?

lguinn2 — Tue, 19 Jun 2012 23:52:56 GMT

The P was part of the syntax when Python first introduced the idea of naming a capture in regular expressions. However, the P is not part of the syntax in some other flavors of regular expressions, most notably Microsoft .NET.

Splunk supports the syntax both ways.

Re: What Is Purpose Of Leading P Argument In Field Extraction Regex?

psmith3 — Wed, 20 Jun 2012 01:02:35 GMT

Great - thanks for the quick response!