Splunk Search

Can I do named capture in transforms.conf FORMAT = ipaddress::$1.$2.$3.$4?

hylam
Contributor

In addition to $1 $2 $3..., does it support (?<namedField>...)?
http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Transformsconf

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, you can, like this:

[SomeArbitraryNameHere]
SOURCE_KEY=YourSourceFieldName
REGEX=Your RegEx with (?<NamedCapture>.*) Here

You need a props.conf reference to SomeArbitraryNameHere to trigger it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Yes, you can, like this:

[SomeArbitraryNameHere]
SOURCE_KEY=YourSourceFieldName
REGEX=Your RegEx with (?<NamedCapture>.*) Here

You need a props.conf reference to SomeArbitraryNameHere to trigger it.

0 Karma

hylam
Contributor

thx it worked

Use $n (such as $1, $2, and so on) to specify regex match outputs. Default is ::$1
Is the default in the Field Transformation GUI suppressed by default?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The way I read this paragraph, groups can only be referred to by number.

When you create concatenated fields with FORMAT, "$" is the only special
character. It is treated as a prefix for regex-capturing groups only if
it is followed by a number and only if the number applies to an existing
capturing group.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...