topic Re: Regex is correct but splunk throws error in Splunk Search

Regex is correct but splunk throws error

amunag439 — Wed, 14 Aug 2019 20:42:28 GMT

For the following log, I would like to filter by a string. I would have to extract the string using regex.

traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_SEND_MACBOOKS\",\"commands\.....}
traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_OPEN_MACBOOKS\",\"commands\.....}

My Splunk query is as follows.
host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" | rex "code\\"\:\\"(?<codes>.{20})" | where codes=ABC_DEF_SEND_MACBOOKS

But splunk throws the below error related to regex
Error in 'rex' command: Encountered the following error while compiling the regex 'code\\:\(?<codes>.{20})': Regex: unmatched closing parenthesis

When I checked the regex in regex101.com, the output for codes is as expected.
What is wrong with the parenthesis in this case?

Re: Regex is correct but splunk throws error

koshyk — Wed, 14 Aug 2019 20:51:42 GMT

my guess is reason of failure is due to you not escaping double quotes "

Try something like..

host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" | rex "code\\\"\:\\\"(?<codes>.{20})"

cheers

Re: Regex is correct but splunk throws error

Sukisen1981 — Thu, 15 Aug 2019 06:49:25 GMT

try this:

    host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" |  rex field=_raw "code\\\+\":+\\\+\"(?<codes>.*?)\\\+" | where codes="ABC_DEF_SEND_MACBOOKS"

in your where condition you also need to have your string within quotes like above