topic Re: Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class" in Splunk Search

Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Task1906 — Thu, 01 Nov 2018 05:12:35 GMT

Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below:
I am trying to extract everything before \ or \

Error in 'rex' command: Encountered the following error while compiling the regex '(?[^].)': Regex: missing terminating ] for character class*

| rex field=src_user "\\(?<user>[^\\].*)"

Here are the examples of what I'm trying to extract:
DTTSOL-EAST\SQLAdmin
DTTSOL-EAST\SQLAdmin
task@delly\mason
DANNY@rand\D
calicoe\iron

What am I doing wrong and should I use something else besides regxex101?

Re: Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

kamlesh_vaghela — Thu, 01 Nov 2018 05:30:26 GMT

@Task1906

Can you please try this?

Your_search  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Sample Search:

| makeresults | eval src_user="DTTSOL-EAST\\SQLAdmin"  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Thanks

Re: Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

javiergn — Thu, 01 Nov 2018 08:43:21 GMT

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

Re: Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Task1906 — Thu, 01 Nov 2018 12:00:28 GMT

thank you!!! It works like a charm.