How to write a regular expression to identify multiple capturing groups?

ankithreddy777 — Thu, 02 Feb 2017 21:23:36 GMT

Hi,
below is the stanza in transforms.conf.

  [rfc5424_header]
  REGEX = <(\d+)>\d{1}\s{1}\S+\s{1}\S+\s{1}(\S+)\s{1}(\S+)\s{1}(\S+)
  FORMAT = prival::$1 appname::$2 procid::$3 msgid::$4

As given, above regex has four capturing groups $1,$2,$3,$4. how to identify how many capturing groups are present in a regular expression?

I know how to write regex to match a text and write regex with single name capturing group, but how do I write regex with multiple capturing groups to extract fields? Don't understand what part of regex represents $1, $2 etc.

Re: How to write a regular expression to identify multiple capturing groups?

mpreddy — Thu, 02 Feb 2017 21:47:43 GMT

Hi Ankit

<(\d+)>\d{1}\s{1}\S+\s{1}\S+\s{1}(\S+)\s{1}(\S+)\s{1}(\S+)

which are enclosed in () is the capturing group

(\d+) - 1st group
(\S+) - 2nd
(\S+)- 3 rd
(\S+)-4 th

topic How to write a regular expression to identify multiple capturing groups? in Splunk Search

How to write a regular expression to identify multiple capturing groups?

Re: How to write a regular expression to identify multiple capturing groups?