Splunk Search

Working regex elsewhere does not work in Splunk

mxanareckless
Path Finder

As seen in the first example, the expression I've constructed will capture the field values I want. However in the second example, all of the values are not being captured for the field I wish to extract. Why is it capturing everything in the first example, but not the second?

Capturing between 1-3 digits followed by 1 of any letter.

spkregex2.PNG

 

spkregex3.PNG

Labels (4)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try a variation of the regex.

(?<size>\d{1,3}\w)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try a variation of the regex.

(?<size>\d{1,3}\w)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...