Need to understand the following expression.

[Nicksyboy]

I recently came across a Splunk expression, as

rex "(?i)\".*? (?P/\w+/((\w+\.\d+)|(\w+\d+))/((\w+/)|(\w+/\w+/)|((\w+/\w+/\w+/)))\D+((\?)|(\s)))\w+"

and due to the usage of toom many forward and backward slash, I am unable to understand it. Can you please help me in the matter?

[gelica · Accepted solution]

I like this site alot for checking regexes: http://www.regexper.com/

The regex needed a little modification, but only escaping "/"
This is the regex I ran to get the site to work:

.*? (\/\w+\/((\w+\.\d+)|(\w+\d+))\/((\w+\/)|(\w+\/\w+\/)|((\w+\/\w+\/\w+\/)))\D+((\?)|(\s)))\w+

[lukejadamec]

Pull a fieldname that is followed by a / then one or more letters followed by a /, which will be followed by one of the following:

one or more letters followed by a . followed by one or more digits, or

one or more letters followed by one or more digits.

This will be followed by a / and then one of the following:

One or more letters, or

One or more letters followed by a / then one or more letters followed by a /, or

One or more letters followed by a / then one or more letters followed by a / then one or more letters followed by a /

This will be followed by one or more Non-digits.

I think that covers all of the /shs.

[lukejadamec]

You should accept the answer so others know the issue is closed.

[lukejadamec]

You are welcome.

[Nicksyboy]

Thanks guys for your quick response!

[lukejadamec]

little d means digit, big D means not a digit. Same with w and W for a letter.

[grijhwani]

s is any whitespace character.

[Nicksyboy]

Thanks for the quick response! So - \w is for words, \d is for digits. What is D and S stands for?