Hi @wlwilliams01,
Use a labeled capturing group instead of (?.) and (?0x0) as shown here :
https://www.regular-expressions.info/named.html
which should look something like this :
(?<name>group)
Also you can use the following site to validate your regex:
www.regex101.com
Let me know if it helps.
Cheers,
David
Hi,
you can not just use (?.) as a group. You need to add a name for at least one group like this:
(?<name>.+)
which would extract the results of the group to a field called "name" in Splunk. If you want to match everything in a group without giving a name you might be able to use (?:).
Greetings
Tom