https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236158#M70142 <P>Hi,</P> <P>I'm having a dickens of a time trying to figure out how to use a question mark as the termination of a search for regex. My data looks like this </P> <PRE><CODE>#### &lt;[ACTIVE] ExecuteThread: '20' for queue: 'weblogic.kernel.Default (self-tuning)'&gt; &lt;&gt; &lt;&gt; &lt;&gt; &lt;1470912327355&gt; &lt;[STUCK] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "662" seconds working on the request "Workmanager: mediaUpload-workManager, Version: 0, Scheduled=true, Started=true, Started time: 662872 ms [ POST /cameraProxy/video?token=MTE0NTg5OjExNDU4OS4xNDcwMzgzNzc1OjExNDU4OS4zOjExNDU4OV83ODAzNDM2NTE3X3ZfMTM2NF80MjM4MjUwOTo2MDAyNTM= HTTP/1.1 </CODE></PRE> <P>And I'm trying to match on the <CODE>?</CODE> just at the end of the /cameraProxy/video URL. My umpteenth try at the regex looks like this</P> <PRE><CODE>GET\s|POST\s+(?&lt;status&gt;\/\w+\/\w+) </CODE></PRE> <P>Which works, but if the URL is digits instead of a word, it wouldn't match. Ideally I'd like to search for the GET / POST, then the space, then match everything up to the <CODE>?</CODE> mark.</P> Tue, 23 Aug 2016 17:25:05 GMT dbcase 2016-08-23T17:25:05Z https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236158#M70142 <P>Hi,</P> <P>I'm having a dickens of a time trying to figure out how to use a question mark as the termination of a search for regex. My data looks like this </P> <PRE><CODE>#### &lt;[ACTIVE] ExecuteThread: '20' for queue: 'weblogic.kernel.Default (self-tuning)'&gt; &lt;&gt; &lt;&gt; &lt;&gt; &lt;1470912327355&gt; &lt;[STUCK] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "662" seconds working on the request "Workmanager: mediaUpload-workManager, Version: 0, Scheduled=true, Started=true, Started time: 662872 ms [ POST /cameraProxy/video?token=MTE0NTg5OjExNDU4OS4xNDcwMzgzNzc1OjExNDU4OS4zOjExNDU4OV83ODAzNDM2NTE3X3ZfMTM2NF80MjM4MjUwOTo2MDAyNTM= HTTP/1.1 </CODE></PRE> <P>And I'm trying to match on the <CODE>?</CODE> just at the end of the /cameraProxy/video URL. My umpteenth try at the regex looks like this</P> <PRE><CODE>GET\s|POST\s+(?&lt;status&gt;\/\w+\/\w+) </CODE></PRE> <P>Which works, but if the URL is digits instead of a word, it wouldn't match. Ideally I'd like to search for the GET / POST, then the space, then match everything up to the <CODE>?</CODE> mark.</P> Tue, 23 Aug 2016 17:25:05 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236158#M70142 dbcase 2016-08-23T17:25:05Z https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236159#M70143 <P>Try this</P> <PRE><CODE> GET\s|POST\s+(?&lt;status&gt;\/[^\?]+) </CODE></PRE> Tue, 23 Aug 2016 17:39:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236159#M70143 sundareshr 2016-08-23T17:39:37Z https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236160#M70144 <P>One day my goal is to be as smart as you Sundareshr! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 23 Aug 2016 17:41:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236160#M70144 dbcase 2016-08-23T17:41:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236161#M70145 <P>Your goal is very near, my friend <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 23 Aug 2016 17:42:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-regular-expression-to-search-for-a-question/m-p/236161#M70145 sundareshr 2016-08-23T17:42:06Z