Splunk Search

Regex Extractions query

MHibbin
Influencer

All,

I just wanted to ask a question I should probably know the answer to, but have never been told, or found resources which answers the question...

I am still fairly new to Regular Expressions, and not aware if this is a specific Splunk question or a RegEx question...

What are the meanings of the values such as (?i) (?P<fieldname>)<-i.e. the "?P" ?

Is there any documentation on this?

Regards,

MHibbin

Tags (1)
1 Solution

rroberts
Splunk Employee
Splunk Employee

(?i) = ignore case

P = added by the python generated regex if you use the Interactive field extractor. Used for grouping.
It will work without the P.

(?< >) = the field name you want to create base on the group extraction.

You can find examples here:
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Createandmaintainsearch-timefieldextract...

View solution in original post

ma_anand1984
Contributor

the letter P didnt do any harm when i used in splunk web search with "rex". But if i use the word in props.conf, it fails to extract field. Not sure why.

0 Karma

rroberts
Splunk Employee
Splunk Employee

Can you post your regex here?

0 Karma

BobM
Builder

This is a PCRE (perl compatible regular expression) declaration of a named capture.

The website http://www.regular-expressions.info/named.html gives a lot of explanation and examples.

MHibbin
Influencer

Useful link thanks BobM

0 Karma

rroberts
Splunk Employee
Splunk Employee

(?i) = ignore case

P = added by the python generated regex if you use the Interactive field extractor. Used for grouping.
It will work without the P.

(?< >) = the field name you want to create base on the group extraction.

You can find examples here:
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Createandmaintainsearch-timefieldextract...

View solution in original post

MHibbin
Influencer

Thanks for explanation, thanks rroberts

0 Karma

Ayn
Legend

The ?P means matched strings are available in the rest of the regex. Most often you probably don't need this.

Splunk uses Python's regex engine, so this documentation is valid: http://docs.python.org/library/re.html

MHibbin
Influencer

Useful information thanks Ayn

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!