Splunk Search

Can I do named capture in transforms.conf FORMAT = ipaddress::$1.$2.$3.$4?

hylam
Contributor

In addition to $1 $2 $3..., does it support (?<namedField>...)?
http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Transformsconf

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, you can, like this:

[SomeArbitraryNameHere]
SOURCE_KEY=YourSourceFieldName
REGEX=Your RegEx with (?<NamedCapture>.*) Here

You need a props.conf reference to SomeArbitraryNameHere to trigger it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Yes, you can, like this:

[SomeArbitraryNameHere]
SOURCE_KEY=YourSourceFieldName
REGEX=Your RegEx with (?<NamedCapture>.*) Here

You need a props.conf reference to SomeArbitraryNameHere to trigger it.

0 Karma

hylam
Contributor

thx it worked

Use $n (such as $1, $2, and so on) to specify regex match outputs. Default is ::$1
Is the default in the Field Transformation GUI suppressed by default?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The way I read this paragraph, groups can only be referred to by number.

When you create concatenated fields with FORMAT, "$" is the only special
character. It is treated as a prefix for regex-capturing groups only if
it is followed by a number and only if the number applies to an existing
capturing group.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...