I have this regex (https?:\/\/)?(www)?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?(.)?([a-z\d-]{2,})?.[a-z]{2,4} that I want to use to extract a new field.
How do I incorporate a field name to that regex to use in field extraction.
Thanks!
you need to define a special group with (?< fieldname >regexmatch)
read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex
Quite possibly, I would say that you may want to try doing some atomic grouping. In other words, for all the grouped up stuff in parentheses, like this:
(https?)...
Change it to;
(?:https?)
Thank you both.
So I changed my search to:
(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})
It works when I do a ... | rex "(?<name>(https?:\/\/)?(www)?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?(\.)?([a-z\d\-]{2,})?\.[a-z]{2,4})" | top 50 name
.
However, if I try to save a field extraction with that same regex I get an error"Encountered the following error while trying to update: In handler 'props-extract': Regex: syntax error in subpattern name (missing terminator)". It might be because of my dirty regex.
Thanks
Hi agodoy,
To extract fields using the Splunk search language, you will want to use the rex command. This is in the syntax of:
|rex field=myFieldName "myRegex(?
More info can be found in the docs.
Looking at your regex, you may want to clean up the regex a little.
Thank you sir! Nice job to you as well!
nice job mister
you need to define a special group with (?< fieldname >regexmatch)
read the documentation for examples :
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Rex