Guys, I have a horrible dataset in Splunk and am trying to match fields based on a position in event.
As an example, I need to extract a field which is found in the 201st and 202nd position of the event. I tried the following extraction (with some iteration) which fails.
| rex (.){200}(?P<FIELD>.{2})
What should it look like?
Thanks!
Remove the parentheses from around the first dot and it should work. Of course, the whole regex string must be quoted.
| rex ".{200}(?P<FIELD>.{2})" | ...
Remove the parentheses from around the first dot and it should work. Of course, the whole regex string must be quoted.
| rex ".{200}(?P<FIELD>.{2})" | ...
Also, anchor it.
| rex "^.{200}(?P<FIELD>.{2})"
Thanks guys!