Splunk Search

Splunk PCRE - Can I use flags?


Hey everyone, this is hopefully a simple question. When we are doing extractions at search time with transforms.conf, can we use flags? For instance, some of our sources have a headerline which we will extract at search time, but the last item on the line is the start of a key value pair which can continue on for N lines. So, using the /<MYREGEXHERE/s would be really useful.

Tags (2)
0 Karma


Yes, you can use flags, using syntax like:

For example "(?i)Msarro" would match your nick, as it would be case insensitive.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!