Doing an extraction in Splunk Stream and get an error when trying to use (?i) in my regex:
(?i)x-forwarded-for([:\s]+[\d\.:\s,]+)
Gives this error:
Invalid regex Expression
This works fine in a rex command, not sure what the Splunk Stream syntax is for case insensitive. Thanks.
↧