\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" That becomes prob" /> \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" That becomes prob" /> \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" That becomes prob"/>

How to use custom delimiters in Sumologic regex parsing

16 Views Asked by At

The standard Sumologic regex delimiter is the double-quote, like so:

parse regex "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

That becomes problematic when you're parsing a message that contains many double-quotes, as you would need to escape each instance. Is there a way to define a custom delimiter?

I've tried things like

parse regex /(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
0

There are 0 best solutions below