Interactive Field Extraction (Regex)

Question

I have my xml data HERE, I need to extract using Splunk IFX, Generated pattern (regex).

Example Xml: <d:Message>(22/7)17:53 Accident on AYE (towards Tuas) after Jurong Port Rd Exit. Avoid lane 3.</d:Message>

I have this expression that extract from word after until Exit. (?i) after (?P<wordafter>.[^\.]*?Exit)

As this look for word Exit only, how do I add other situation such as Rd|Entrance ? I tried (?i) after (?P<wordafter>.[^\.]*?Exit|Entrance|Rd), it wont work.

Answer 1

I guess you need to surround alternation with () like (?i) after (?P<wordafter>.[^\.]*?(Exit|Entrance|Rd)).

Well, if it doesn't like unnamed groups, maybe you can do it this?

(?i) after (?P<wordafter>.[^\.]*?(?P<dummy>Exit|Entrance|Rd))