topic Re: Regex Extractions query in Splunk Search

Regex Extractions query

MHibbin — Wed, 30 Nov 2011 21:10:44 GMT

All,

I just wanted to ask a question I should probably know the answer to, but have never been told, or found resources which answers the question...

I am still fairly new to Regular Expressions, and not aware if this is a specific Splunk question or a RegEx question...

What are the meanings of the values such as (?i) (?P<fieldname>)<-i.e. the "?P" ?

Is there any documentation on this?

Regards,

MHibbin

Re: Regex Extractions query

Ayn — Wed, 30 Nov 2011 21:30:25 GMT

The ?P means matched strings are available in the rest of the regex. Most often you probably don't need this.

Splunk uses Python's regex engine, so this documentation is valid: http://docs.python.org/library/re.html

Re: Regex Extractions query

rroberts — Wed, 30 Nov 2011 21:35:08 GMT

(?i) = ignore case

P = added by the python generated regex if you use the Interactive field extractor. Used for grouping.
It will work without the P.

(?< >) = the field name you want to create base on the group extraction.

You can find examples here:
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

Re: Regex Extractions query

BobM — Wed, 30 Nov 2011 21:51:59 GMT

This is a PCRE (perl compatible regular expression) declaration of a named capture.

The website http://www.regular-expressions.info/named.html gives a lot of explanation and examples.

Re: Regex Extractions query

MHibbin — Wed, 30 Nov 2011 21:54:52 GMT

Useful information thanks Ayn

Re: Regex Extractions query

MHibbin — Wed, 30 Nov 2011 21:55:56 GMT

Useful link thanks BobM

Re: Regex Extractions query

MHibbin — Wed, 30 Nov 2011 21:56:16 GMT

Thanks for explanation, thanks rroberts

Re: Regex Extractions query

ma_anand1984 — Tue, 24 Apr 2012 08:41:08 GMT

the letter P didnt do any harm when i used in splunk web search with "rex". But if i use the word in props.conf, it fails to extract field. Not sure why.

Re: Regex Extractions query

rroberts — Tue, 24 Apr 2012 15:37:03 GMT

Can you post your regex here?