Regex sanity check - fixed record length field extraction

[himynamesdave]

Guys, I have a horrible dataset in Splunk and am trying to match fields based on a position in event.

As an example, I need to extract a field which is found in the 201st and 202nd position of the event. I tried the following extraction (with some iteration) which fails.

| rex (.){200}(?P<FIELD>.{2})

What should it look like?

Thanks!

[richgalloway · Accepted solution]

Remove the parentheses from around the first dot and it should work. Of course, the whole regex string must be quoted.

 | rex ".{200}(?P<FIELD>.{2})" | ...

[jacobwilkins]

Also, anchor it.

| rex "^.{200}(?P<FIELD>.{2})"

[himynamesdave]

Thanks guys!