Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Regular expression by specifying the beggining

$
0
0
Hi all, I have no idea. I have many event like this. /abc_d/efg_h/abcd_ef/1234/ghi_jk/ /abc_d/efg_h/zxcv_vf/56789/sdfg_h/ abc_d/egf_h/dfghh_h/5y865/ghjk_r/ /abc_d/efg_h/ is common. so, I want to do regular expression by specifying the beggining. I think it is working. |rex field=_raw"(?[/abc_d/efg_h]/\w+_\w+/\w+/\w+_\w+)" but Error happen. I know I am wrong, but I have no idea. I wish this was recognized as a field by default..........(;;) Could you help me? Thank you.

Viewing all articles
Browse latest Browse all 47296

Trending Articles