Field extractions what is the difference between (?P.+) and (?.+)?

[chris]

When I extract Fields from a source/sourcetype through Splunk web using the "Extract Fields" context menu on an event. Splunk seems to generate a regex that conatins an uppercase P before the fieldname. Does anyone know what this does?

Are those equivalent?

(?P<field_name>.+) and (?<field_name>.+)?

Thanks

Chris

[jonuwz · Accepted solution]

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)

[MarioM]

i am not sure it does anything special...outside pointing to perl or python:

(?<name>pattern) - Named group (Perl)

(?P<name>pattern) - Named group (Python)

Named groups appears to be a Python-specific extension to regex.

[chris]

Makes sense