This is for an Ingest Processor pipeline.  I have hundreds of fields I want to redact as events pass through the pipeline .  The regex for each includes the fieldname to look for and lots of complex regex for the various formatting options. So rather than repeat that complex formatting lots of times I was thinking of a loop to loop through a list of the field names, assemble the regex, then process it. Or maybe just a command for each fielname to search for that calls a function that assembles the regex and executes the rex command. But I am starting to thing that SPL2 cant do this.  I better go do some more ready. thanks ... View more

Thanks _ I will have a look into this. ... View more

Hi Giuseppe, Thanks for showing an interest. I will try to include everything with this example: The code is: $pipeline = | from $source | rex "postCode:(?P<postCode1>\\d+)" | eval regexstrA= "postCode:(?P<postCodeA>\\d+)" | eval regexstrB= "postCode:(?P<postCodeB>\\\\d+)" //| rex regexstrA //| rex regexstrB | into $destination; the sample data is  blah blah postCode:4548 blah blah when I run it you can see the field value extracts properly and the fields in lines 3 and 4 also get created and you can see their contents: But if I run with line 5 uncommented I get this error: Error in 'rex' command: The regex 'regexstrA' does not extract anything. It should specify at least one named group. Format: (?<name>...). and a similar error if I uncomment line 6. Any ideas why? Thanks   ... View more

Thanks Sainag, Just confusing doco then as this page: https://docs.splunk.com/Documentation/SCS/current/SearchReference/rexcommandexample which is all about SPL2  in section 2 has examples without the P after the ?  but section 3 has the P all good, thanks ... View more