topic Re: Regex - Capture group without duplicating value in Splunk Search

Regex - Capture group without duplicating value

ben_leung — Fri, 12 Sep 2014 23:37:43 GMT

This is my string

<search>1</search> <search>4</search> <search>2</search> <search>5</search> <search>3</search> <search>6</search>

I have the following rex command rex field=a_field "<search>(?<TESTING>(.?))</search>"
This will only grab TESTING=1. I want to grab all the values.

Using the rex command rex field=a_field "<search>(?<TESTING>.*)</search>"
will grab everything in-between, including the brackets and search string.

How would I make sure that I only grab the values between the bracketed strings?

Re: Regex - Capture group without duplicating value

twinspop — Sat, 13 Sep 2014 01:05:25 GMT

max_match:

| rex field=foo max_match=99 ....

Unless I'm misunderstanding the question

Re: Regex - Capture group without duplicating value

ben_leung — Sat, 13 Sep 2014 02:27:31 GMT

Perfect! Thank you for this parameter for the rex command.

Re: Regex - Capture group without duplicating value

martin_mueller — Sat, 13 Sep 2014 09:24:33 GMT

Additionally, take a look at non-greedy matching in regex. This will greedily match everything until the last closing tag:

<search>(?<TESTING>.*)</search>

While this will non-greedily match only the bit until the first closing tag:

<search>(?<TESTING>.*?)</search>

Note the question mark after the asterisk.