Splunk Stream Case Insensitive Extraction

[tjago11]

Doing an extraction in Splunk Stream and get an error when trying to use (?i) in my regex:

(?i)x-forwarded-for([:\s]+[\d\.:\s,]+)

Gives this error:

Invalid regex Expression

This works fine in a rex command, not sure what the Splunk Stream syntax is for case insensitive. Thanks.

[tjago11 · Accepted solution]

Ick, I feel dirty but this works.

[xX][-_][fF][oO][rR][wW][aA][rR][dD][eE][dD][-_][fF][oO][rR][:\s]+([\d\.:\s,]+)

I'll not accept this answer yet because it feels gross.

[tjago11]

Well, I guess the ick answer is better than no answer.