Splunk Search

REX Non-Capture Group

subtrakt
Contributor

Hi Everyone,

Trying to understand non-capture groups better

Trying to build rex that captures 2 conditions but uses a non-capture for condition one.

Condition one (non capture): Non Capture Message= but capture everything after (Message=)

Condition two: Everything after (:\d:)

Here's what I ended up with but "Message" still shows up in the results:

    | rex "(?i)(?P<TEST>((:\d:)|(?:(Message\=)))[^\$]*)" 
Tags (2)
0 Karma

woodcock
Esteemed Legend

The main reason to have a non-capture group is because you need to do something to that thing as a group of text but not put it into a field. For example, in a CSV, to grab the 30th thing, you might use this:

| rex "^(?:[^,]*,){29}(?<csv30>[^,]*)"

So because I needed to skip 29 of the same thing, I put that thing (a CSV field plus the delimiting comma) into a (non-capturing) group and applied the multiplier {29}. Then I capture the next thing and name it.

So is your question truly academic or are you trying to do something with some data? If you are trying to do something, then show us the sample event data and describe what fields that you would like to create and we can help some more.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...