topic rex giving unrecognized character in Splunk Search

rex giving unrecognized character

shobhitdesh — Mon, 10 Sep 2018 11:35:45 GMT

Regular expression

 "ParNew:" | rex "(?i)\\), (?P[^ ]+)" | rex "(?i).*?\\((?P\\d+\\w+)(?=\\))" | rex "(?i)\\[ParNew: (?P[^\\-]+)" | rex "(?i)\\->(?P[^\\(]+)" | table COLLECTION_TIME, HEAP_SIZE_AVAILABLE, OBJECT_SIZE_BEFORE_GC, OBJECT_SIZE_AFTER_GC

gives error in 'rex' command: Encountered the following error while compiling the regex '(?i)), (?P[^ ]+)': Regex: unrecognized character after (?P

Re: rex giving unrecognized character

richgalloway — Mon, 10 Sep 2018 12:00:02 GMT

The system mangled your regex so it's difficult to see what may be wrong.
Please edit or comment with the regex string inside backtick characters so it's displayed fully.

Re: rex giving unrecognized character

inventsekar — Mon, 10 Sep 2018 12:54:59 GMT

as @richgalloway said, the rex query got damaged..
maybe you can update a screenshot your error when you run this cmd on screen on your splunk web GUI
or, put your rex query inside backticks (something)

Re: rex giving unrecognized character

DalJeanis — Mon, 10 Sep 2018 13:36:28 GMT

Your query should have a field name in angle brackets after the (?P, and the P is unneeded. ... so something like (?<fieldname>.*)

Re: rex giving unrecognized character

mstjohn_splunk — Mon, 10 Sep 2018 20:32:12 GMT

hi @shobhitdesh

Did any of the answers or comments below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!