Splunk Search

Rexgex Non-capturing group - still capturing?

tb5821
Communicator
rex field=title "(?titleNEW(.*?)(?:-))"

I have this rex command above but it still outputs the dash at the end which is in a non-capturing group- any help?

Labels (1)
Tags (2)
0 Karma
1 Solution

tb5821
Communicator

Figured this out - by changing where the new field name paranthesie was...

rex field=title "(?<titleNEW>(.*?))(?:-)"

View solution in original post

tb5821
Communicator

Figured this out - by changing where the new field name paranthesie was...

rex field=title "(?<titleNEW>(.*?))(?:-)"

jotne
Builder

Not sure if you have an optimal regex.  Why do you make a non capturing group of "-" and why a capture group in the named group?  This is some better:

rex field=title "(?<titleNEW>.*?):-"

 Even better, do not use * in regex when its not needed.  Do a search until you find some that its not included, like this:

rex field=title "(?<titleNEW>[^-]+)"

 

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...