Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

regex help

$
0
0
I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex **^(?:[^:\n]*:){4}\s+(?P[^\|]+)**, but am seeing additional values. The output should be all uppercase, but I'm still getting some lowercase values after using the **[A-Z]** in the regex. I've also tried to pin point the outputs using the below but still get the additions. **^(?:[^:\n])\s state\s:\s(?P[^\|]+)** What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - ()[]{}| The output should be - **ROUTE_START** But I'm also seeing things like - I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex **^(?:[^:\n]*:){4}\s+(?P[^\|]+)**, but am seeing additional values. The oput put should be all uppercase, but I'm still getting some lowercase values after using the **[A-Z]** in the regex. I've also tried to pin point the outputs using the below but still get the additions. **^(?:[^:\n])\s state\s:\s(?P[^\|]+)** What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - **()[]{}|** The out put should be - **ROUTER** But I'm also seeing this like - **[Order{** Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>