Splunk Search

Splunk PCRE - Can I use flags?

msarro
Builder

Hey everyone, this is hopefully a simple question. When we are doing extractions at search time with transforms.conf, can we use flags? For instance, some of our sources have a headerline which we will extract at search time, but the last item on the line is the start of a key value pair which can continue on for N lines. So, using the /<MYREGEXHERE/s would be really useful.

Tags (2)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

Yes, you can use flags, using syntax like:
http://www.regular-expressions.info/modifiers.html

For example "(?i)Msarro" would match your nick, as it would be case insensitive.

Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...