topic Re: What is causing the Rex Raw c-ip syntax error? in Splunk Search

What is causing the Rex Raw c-ip syntax error?

brdr — Wed, 18 Apr 2018 12:54:35 GMT

Hi,

I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)

My rex expression is this:

index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

Blue log snippet is :

[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

What am I doing wrong? Is it the '-' between the <>? If so how do i escape?

Thanks

Re: What is causing the Rex Raw c-ip syntax error?

elliotproebstel — Wed, 18 Apr 2018 13:04:41 GMT

Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.

Re: What is causing the Rex Raw c-ip syntax error?

brdr — Wed, 18 Apr 2018 13:56:53 GMT

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

Re: What is causing the Rex Raw c-ip syntax error?

elliotproebstel — Wed, 18 Apr 2018 14:08:04 GMT

Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:

index = bcoat 
| head 1 
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"

Re: What is causing the Rex Raw c-ip syntax error?

brdr — Wed, 18 Apr 2018 14:19:04 GMT

thank you!