Splunk : Detail discussion on PCRE regular expression

[@manigandanumapathy4840]

Appreciate your effort for making this video on Diwali. This proves that how much you are interested in teaching. Cheers!!

[@splunk_ml]

Thanks Mani :) Yes I enjoy creating content...specially on education genre....

[@RamuChittiprolu]

Though I'm working on regular expressions, I always find little challenging. Thanks for your detailed analysis. You are awesome bro!!

[@Beni11188]

Thanks for sharing!

[@Sandeep223358]

Can we expect Splunk add-on for tomcat logs??

[@nagarjunareddy3114]

Could you make a video on inline and transform field extraction

[@splunk_ml]

Hi Nagarjuna, Yes I have a plan to cover field extraction in my next video. Sid

[@kushagrajain6285]

amazing video !!! Thanks In password validation can we use (.*[0-9]{2}) instead of (.*[0-9].*[0-9] . will it be same??

[@splunk_ml]

nope , (.*[0-9]{2}) means you are searching for 2 digits one after another, (.*[0-9].*[0-9]) means you are searching for 2 digits only , they can appear anywhere like, AA@2ac2c.

[@Sandeep223358]

How can we use the same named group multiple times?I have tried this with OR but the it is picking up the latest one.

[@splunk_ml]

in splunk rex command there is an input called max_match, if you set that to zero , it will extract all the occurrences of the regular expression.

[@Sandeep223358]

Splunk & Machine Learning how to use this setting while extracting fields from field extraction utility?

[@splunk_ml]

I dont think its possible in field extraction page. But using rex or field extraction page both are same as both of them are search time operation.

[@Sandeep223358]

Splunk & Machine Learning Yes but I don't think it will be saved when we are executing with rex command.correct me If I am wrong

[@splunk_ml]

If you want to save it in conf file you need to go for transforms.conf... There is a settings called REPEAT_MATCH

[@sanjais5766]

thanks