Splunk Search

Field extractions what is the difference between (?P.+) and (?.+)?

Motivator

When I extract Fields from a source/sourcetype through Splunk web using the "Extract Fields" context menu on an event. Splunk seems to generate a regex that conatins an uppercase P before the fieldname. Does anyone know what this does?

Are those equivalent?

(?P<field_name>.+) and (?<field_name>.+)?

Thanks

Chris

Tags (3)
0 Karma
1 Solution

Influencer

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)

View solution in original post

Influencer

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)

View solution in original post

Motivator

i am not sure it does anything special...outside pointing to perl or python:

(?<name>pattern) - Named group (Perl)

(?P<name>pattern) - Named group (Python)

Named groups appears to be a Python-specific extension to regex.

Motivator

Makes sense

0 Karma