Concatenate onto Regex

[edschembor]

I'm trying to concatenate something onto one of my regex's.

ie:

index=eph | rex "EPH(?P<EPHID>\d+)" | table EPHID, _raw

I want the EPHID regex to be EPH902834091 instead of just 902834091. So even though the regex is "EPH(?P\d+)", I want the "EPH" at the beginning included. Is there a way to do this?

Thanks!!!

[Ayn]

Just include the EPH in the matching group.

index=eph | rex "(?<EPHID>EPH\d+)" | table EPHID, _raw

[aweitzman · Accepted solution]

Why not just include it in the group?

rex "(?<EPHID>EPH\d+)"