- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller

SplunkTrust
11-25-2014
07:01 AM
Converted from http://answers.splunk.com/answers/193524/how-to-write-a-search-to-return-events-with-a-vari.html
Hi,
i want to extract this field language:
language:ru-ru
can you please help me what regular expression should i write?
Thanks,
Snabel
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller

SplunkTrust
11-25-2014
07:01 AM
Try this:
language:(?<language>\w+-?\w*)
In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller

SplunkTrust
11-25-2014
07:01 AM
Try this:
language:(?<language>\w+-?\w*)
In the long run you should consider setting up key-value extraction around the colon instead of the equals sign.
