Splunk Search

Regex Extractions query

Influencer

All,

I just wanted to ask a question I should probably know the answer to, but have never been told, or found resources which answers the question...

I am still fairly new to Regular Expressions, and not aware if this is a specific Splunk question or a RegEx question...

What are the meanings of the values such as (?i) (?P<fieldname>)<-i.e. the "?P" ?

Is there any documentation on this?

Regards,

MHibbin

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

(?i) = ignore case

P = added by the python generated regex if you use the Interactive field extractor. Used for grouping.
It will work without the P.

(?< >) = the field name you want to create base on the group extraction.

You can find examples here:
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Createandmaintainsearch-timefieldextract...

View solution in original post

Contributor

the letter P didnt do any harm when i used in splunk web search with "rex". But if i use the word in props.conf, it fails to extract field. Not sure why.

0 Karma

Splunk Employee
Splunk Employee

Can you post your regex here?

0 Karma

Builder

This is a PCRE (perl compatible regular expression) declaration of a named capture.

The website http://www.regular-expressions.info/named.html gives a lot of explanation and examples.

Influencer

Useful link thanks BobM

0 Karma

Splunk Employee
Splunk Employee

(?i) = ignore case

P = added by the python generated regex if you use the Interactive field extractor. Used for grouping.
It will work without the P.

(?< >) = the field name you want to create base on the group extraction.

You can find examples here:
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/Createandmaintainsearch-timefieldextract...

View solution in original post

Influencer

Thanks for explanation, thanks rroberts

0 Karma

Legend

The ?P means matched strings are available in the rest of the regex. Most often you probably don't need this.

Splunk uses Python's regex engine, so this documentation is valid: http://docs.python.org/library/re.html

Influencer

Useful information thanks Ayn

0 Karma