Field extraction regex problem

mrdaniel — Wed, 20 Apr 2011 08:54:47 GMT

I have logs that looks like thos

1: username

So I would like to extract the username from two systems named system1 and system2, when trying to do this in Splunk it fails using a regex that works when I try it outside Splunk

(?i)(system1|system2)(?-i) (?<SYS_Username>[A-z]+).*

If i do

(?i)system1(?-i) (?<SYS_Username>[A-z]+).*

It works perfect, but only for one system.. The problem seems to come when i introduce the ( | ) syntax.

Re: Field extraction regex problem

afaraino — Wed, 20 Apr 2011 10:27:30 GMT

Hi,
Could you try that :

(?i)(?:system1|system2)(?-i) (?<SYS_Username>[A-z]+).*

(?:) says "don't capture"

Alex

topic Field extraction regex problem in Splunk Search

Field extraction regex problem

Re: Field extraction regex problem