Error: Regex: Missing Closing Parenthesis

mahesh27 — Mon, 23 Sep 2024 00:12:16 GMT

With following search getting error as Missing Closing Parenthesis in splunk.
tried same rex in regex101 it was working.

index=digitalguardian "appStatus"
|rex ,\\"appStatus\\":\\"(?<status>\w+\s\w+)\\"

2024-02-21 {\"callCenterrecontactevent\":{\"customer\":{\"id\":\"6ghty678h\", \"idtypecd\":\"connect_id\"}, \"languagecd\":\"eng\",\"vhannelInstance\":: {\"status\":{\"serverStatusCode\":\"400\",\"severity\":\"Error\",\"additionalStatus\":[{\"statusCode\":400, \"appStatus\":\"Schema Validation\",\"serverity\":\"Error\"

Re: Error: Regex: Missing Closing Parenthesis

richgalloway — Mon, 23 Sep 2024 00:40:23 GMT

First, the regular expression in the rex command must be enclosed in quotation marks.

Second, you're being caught by rex's escape trap. Embedded quotation marks must be escaped, but the multiple levels of parsing in SPL call for 3 escape characters.

| rex ", \\\\\"appStatus\\\\\":\\\\\"(?<status>\w+\s\w+)\\\\\""

topic Error: Regex: Missing Closing Parenthesis in Dashboards & Visualizations

Error: Regex: Missing Closing Parenthesis

Re: Error: Regex: Missing Closing Parenthesis