Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Interactive Field Extraction (regex)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have my data here Xml Data, I need to extract using Splunk IFX, Generated pattern (regex).
Example 1:
Example 2:
Example 3:
Help 1: I need to extract the express-way exits on the word after and stops at .
Help 2: I need to extract the express-way exits on the word before and stops at Exit
Help 3: I need to extract the express-way exits on the word before and stops at with
There are still a lot of examples in the Xml Data.
I did (?i) before (?P<wordafter>.[^\.]*?Exit) , this extracts the Fort Rd Exit (Example 2), this extract only before, how can I extract after ? together with this expression.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After hours of trying, solved by (?i) (?P
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After hours of trying, solved by (?i) (?P
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
Can you tell me if i and P are exactly typed like this or you substituted field names in here?
Thinking this (with changes) may be my answer
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
