Adding a fieldname to a regex extraction

[agodoy]

I have this regex (https?:\/\/)?(www)?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?.[a-z]{2,4} that I want to use to extract a new field.

How do I incorporate a field name to that regex to use in field extraction.
Thanks!

[Rob]

Quite possibly, I would say that you may want to try doing some atomic grouping. In other words, for all the grouped up stuff in parentheses, like this:

(https?)...

Change it to;

(?:https?)

[agodoy]

Thank you both.

So I changed my search to:

(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})

It works when I do a ... | rex "(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})" | top 50 name.

However, if I try to save a field extraction with that same regex I get an error"Encountered the following error while trying to update: In handler 'props-extract': Regex: syntax error in subpattern name (missing terminator)". It might be because of my dirty regex.

Thanks

[Rob]

Hi agodoy,

To extract fields using the Splunk search language, you will want to use the rex command. This is in the syntax of:

|rex field=myFieldName "myRegex(?regexToMatchValueForMyNewField)anyOtherRegex"

More info can be found in the docs.

Looking at your regex, you may want to clean up the regex a little.

[Rob]

Thank you sir! Nice job to you as well!

[yannK]

nice job mister

[yannK · Accepted solution]

you need to define a special group with (?< fieldname >regexmatch)

read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex