Splunk Search

Field extractions what is the difference between (?P.+) and (?.+)?

chris
Motivator

When I extract Fields from a source/sourcetype through Splunk web using the "Extract Fields" context menu on an event. Splunk seems to generate a regex that conatins an uppercase P before the fieldname. Does anyone know what this does?

Are those equivalent?

(?P<field_name>.+) and (?<field_name>.+)?

Thanks

Chris

Tags (3)
0 Karma
1 Solution

jonuwz
Influencer

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)

View solution in original post

jonuwz
Influencer

For capturing groups - there is no real difference

given the string : "<data>stuff</data>"

You can do this

| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"

This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'

So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.

In non-jargon...

node = everything betwenn the < and the next >

text = everything between <node> and the next instance of </node> (whatever string 'node' might be)

MarioM
Motivator

i am not sure it does anything special...outside pointing to perl or python:

(?<name>pattern) - Named group (Perl)

(?P<name>pattern) - Named group (Python)

Named groups appears to be a Python-specific extension to regex.

chris
Motivator

Makes sense

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...