Hi, i don't know where is the problem. The search it's:
| rex '(?<field>H.+)\\'
| table field
I want to use regular express. for parsing field and i want to show in output the result. The field got a path like \Pc\Hardware\Nice\ok . I want to get all of the words after Pc\.
I don't know how to solve, he literaly does nothing and return the same origin data.
Thank u
You have to double-up on backslashes in Splunk regex - compared to something that works in regex101.com for example
| rex "(?<field>H.+)\\\\"
Top bro. I'm learning from regex101, so i didn't know that. Thank u man
You have to double-up on backslashes in Splunk regex - compared to something that works in regex101.com for example
| rex "(?<field>H.+)\\\\"