Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Extracting two types of fields in a query (IFX)

$
0
0

I have my xml data HERE, I need to extract using Splunk IFX, Generated pattern (regex).

Example Xml: <d:message>(22/7)17:53 Accident on AYE (towards Tuas) after Jurong Port Rd Exit. Avoid lane 3.</d:message>

I have this expression that extract from word after until Exit. (?i) after (?P<wordafter>.[^.]*?Exit)

As this look for word Exit only, how do I add other situation such as Rd|Entrance ? I tried (?i) after (?P<wordafter>.[^.]*?(Exit|Entrance|Rd)), it gives me Invalid regex: no named extraction at position 39 (i.e., "?(Exit|Ent..."). Expected "(?P<variable>pattern)"


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>