Refine your search:

Hi

I was trying to go thru Splunk Tutorial, but now I am having trouble in getting sampledata.zip indexed using the host regex shown in the Splunk Tutorial page. My Splunk is on Windows.

Sampledata.zip:./([^/]+)/

http://docs.splunk.com/Documentation/Splunk/latest/User/Adddatatutorial

Is this regex good for Windows Splunk?

Thanks,

asked 01 May '12, 18:25

melonman's gravatar image

melonman
1.2k2320
accept rate: 54%


2 Answers:

In 4.3.2, I confirmed this is working for both type of OS.

  • For Unix OS : Sampledata.zip:./([^/]+)/
  • For Windows : Sampledata.zip:.\\([^/]+)/

** The regex in Tutorial Doc is not working, be careful.

link

answered 25 Jun '12, 07:11

melonman's gravatar image

melonman
1.2k2320
accept rate: 54%

edited 25 Jun '12, 07:12

No as path where it will be extracted will be \ rather than / then try :

Sampledata\.zip:.\\([^\\]+)\\
link

answered 02 May '12, 00:29

MarioM's gravatar image

MarioM
2.7k47
accept rate: 20%

edited 02 May '12, 00:40

I saw regex for windows in tutorial, thank you!

(04 Jun '12, 05:37) melonman

Well, the regex in tutorial is not working.

(25 Jun '12, 06:40) melonman
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×8

Asked: 01 May '12, 18:25

Seen: 896 times

Last updated: 25 Jun '12, 07:12

Copyright © 2005-2012 Splunk Inc. All rights reserved.