Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Interactive Field Extraction (regex)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have my data here Xml Data, I need to extract using Splunk IFX, Generated pattern (regex).
Example 1:
Example 2:
Example 3:
Help 1: I need to extract the express-way exits on the word after and stops at .
Help 2: I need to extract the express-way exits on the word before and stops at Exit
Help 3: I need to extract the express-way exits on the word before and stops at with
There are still a lot of examples in the Xml Data.
I did (?i) before (?P<wordafter>.[^\.]*?Exit) , this extracts the Fort Rd Exit (Example 2), this extract only before, how can I extract after ? together with this expression.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After hours of trying, solved by (?i) (?P
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After hours of trying, solved by (?i) (?P
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
Can you tell me if i and P are exactly typed like this or you substituted field names in here?
Thinking this (with changes) may be my answer
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
