When extracting a field using a regex, what does the P argument do (the P character between the question mark and the field name)? I have seen examples with and without this argument, but I don't see any obvious difference in the results. For example:
(?i) Finished (?P .+)
versus
(?i) Finished (? .+)
I looked in the Splunk manual and on the Answers site but couldn't find any description of this argument. Apologies if I'm missing something obvious.
... View more