Source > Regular expression
August 22, 2024
ID 198835
Defines a regular expression for an event source.
Path
InputSettings > RegExps > Source > %RegexpName%
This element has the name of the regular expression.
Attributes
This element has the following attributes.
%RegexpName% element attributes
Attribute | Description |
---|---|
| Sets a rule for creating a compound value from data extracted from an event. |
| The Possible values are The The |
| Specifies the type of value that is extracted by this regular expression. Possible values:
This attribute is optional. If it is omitted, the default |
| Specifies if the extracted value that matched a specified regular expression must be used for a retrospective scan. If the extracted value must be used for the retrospective scan, the value of this attribute is If the extracted value must not be used for the retrospective scan, the value of this attribute is This attribute cannot be used within elements where the |
Value
This element contains a Boost regular expression.
Example
The following is an example of this element.
<RE_MD5 type="MD5" use_for_retroscan="true" extract="all">([\da-fA-F]{32})</RE_MD5> |