Skip to content

Instantly share code, notes, and snippets.

View transforms-re.py
#!/opt/splunk/bin/python2
import re
def transform(line):
txf = re.search(r'\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}\s(?:[\w.]+\s)?\(?([\w-]+)\)?', line, re.M|re.I)
if txf:
return( txf.group(1) )
else: