Regex - Ignore Whitespace

[vragosta]

Is it possible to create a regex to ignore whitespace? Typically you can use /x to do this, but this does not seem to work in Splunk. I have also tried putting (?x) at the front of the regex, but this fails as well.

So, is there a modifier to ignore whitespace?

Also, is there any good documentation on all of the available regex modifiers within Splunk?

Thanks!

[jonuwz]

where are the regexes ? in transforms.conf or in the rex search command ? Do you have an example ? how does it fail? Its feasible that transforms.conf is read line by line, so multi-line regexes would be garbled, but id expect errors on splunk start in that case

[rgcurry]

From the Splunk Community Wiki, there is an article about this titled "RegEx Testing Tools" which starts with " Splunk uses Perl compatible regular expressions". This might help you with what you can and cannot use.

Have you tried using "\S+" (note the 's' is capitalized)? How about "(?!\s+)" for a negative lookahead?

Perhaps if you provide an example of your source for which you want this to work, someone can provide a sample RegEx to do what is wanted and needed.

[jonuwz]

(?x) allows you to insert comments into your regex provided they're inbetween character classes examples