Hi @wlwilliams01,
Use a labeled capturing group instead of (?.)
and (?0x0)
as shown here :
https://www.regular-expressions.info/named.html
which should look something like this :
(?<name>group)
Also you can use the following site to validate your regex:
www.regex101.com
Let me know if it helps.
Cheers,
David
Hi,
you can not just use (?.)
as a group. You need to add a name for at least one group like this:
(?<name>.+)
which would extract the results of the group to a field called "name" in Splunk. If you want to match everything in a group without giving a name you might be able to use (?:)
.
Greetings
Tom