Hello Expert,
I have the following text.
anything followed by anything and ended by an empty line
what is the regular expression that look familiar to you?
(space<?Total>.*)
or
(Total<?space>.*)
This is not actually my question cause it depend on the definition below wich started by look followed by familiar , but i really need to determine what character mean go till the end of a text not the end of a line
Any idea from where this is belong? It should be one character i suppose and it's C!
So see C is very difficult for a parsing language like Splunk. I just wondering if someone could help me finding this character on splunk cause i already suggested new one that doesn't work in technology maybe end of an all could be + for repeat or something like that could & be the solution for example .& , it's not a star .* what could be a bottle neck with white color , how about W as of WWW world wide web for example .W , i suppose it should be simple but as long as the wisdom have 2 spaces on the floor and on the roof , i choose to be on the roof cause this is planned. But the thing that isn't planned is your answers to this question.
Any idea what character determine the end of a text body wich is supposed to be followed by a point. .N .T .^ .G .! .@ any idea what character is it?
Many thanks and sorry if i'm bothering you with that silly question.
I need a Splunk character with an example if this is possible
sourcetype="imap" | rex field=_raw "(Total<?space>.?)"
Hark! Me thoughts begin to ponder upon your stated intentions. Hearing only wonders of Regex and Confucianism, I direct my cerebral temperament to a solution. If you wish to capture all information until a line return, try the below supposition!
sourcetype="imap" | rex field=_raw "Total(?<body>[^\r\n]+)"
Hark! Me thoughts begin to ponder upon your stated intentions. Hearing only wonders of Regex and Confucianism, I direct my cerebral temperament to a solution. If you wish to capture all information until a line return, try the below supposition!
sourcetype="imap" | rex field=_raw "Total(?<body>[^\r\n]+)"
