topic Re: Regex: Why am I getting this syntax error in subpattern name (missing terminator)? in Splunk Search

Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

Jewatson17 — Mon, 12 Feb 2018 13:46:27 GMT

I keep getting the missing terminator error when trying to parse. I am not sure whats the problem

Here is my regex:

| rex field=referer "/en-US/app(?<<app>>[^/]+)/(?<<dashboard>&g>;[^?/\s]+)"

Re: Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

493669 — Mon, 12 Feb 2018 14:30:50 GMT

Hi @Jewatson17,
Try this:

| rex field=referer "\/en-US\/app\/(?<app>[^\/]+)\/(?<dashboard>[^?]+)"

Re: Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

gcusello — Mon, 12 Feb 2018 14:35:01 GMT

Hi Jewatson17,
could you share an example of the log to parse?
it seems that you want to parse the address of a dashboard,
if this is true probably the problem is a missed slash (/) and something elase, try something like this:

| rex field=referer "/en-US/app/(?<my_app>[^/]+)/(?<my_dashboard>[^?/ ]+)"

Bye.
Giuseppe

Re: Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

Jewatson17 — Mon, 12 Feb 2018 14:41:05 GMT

I'm trying to pull the usage of ALL the dashboards in my environment.

Re: Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

FrankVl — Mon, 12 Feb 2018 14:48:36 GMT

Escaping the forward slashes is not even necessary I think. Key thing to fix is the redundant characters and the &g and ; in the dashboard field extraction.