topic Re: Field extraction receiving error message in Splunk Search

Field extraction receiving error message

atatistcheff — Fri, 22 Nov 2019 15:48:05 GMT

Any time I try using the Extract Field option in an event list the next page returns this error:

Error in 'rex' command:

The regex '//' does not extract anything. It should specify at least one named group. Format: (?...).

This used to work but it's been a few months since I tried it. I'm not doing anything special as you can see. The regex is just // yet it returns nothing. I tried restarting Splunk but I think something is broken somewhere.

Re: Field extraction receiving error message

uagrawal_splunk — Fri, 22 Nov 2019 16:18:22 GMT

According to me, you have to mention field name in rex, which you can use further,
like (?<Name>//)

Please refer doc for more info:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex

Re: Field extraction receiving error message

atatistcheff — Fri, 22 Nov 2019 16:24:38 GMT

Thanks for the answer but I have no way to mention a field name. To be clear, all i'm doing is clicking the Extract Fields option in the event and getting an error. Please see the screenshots below.

Re: Field extraction receiving error message

uagrawal_splunk — Fri, 22 Nov 2019 16:32:46 GMT

The screenshots are not attached.

Re: Field extraction receiving error message

atatistcheff — Fri, 22 Nov 2019 16:37:27 GMT

Sorry, I'm not good at attaching. See if you can find them here.

Re: Field extraction receiving error message

uagrawal_splunk — Fri, 22 Nov 2019 16:48:37 GMT

In which Splunk Version you are getting this error?

Re: Field extraction receiving error message

atatistcheff — Fri, 22 Nov 2019 16:49:10 GMT

I found the problem, there was a field extraction saved with just // in the regex. Not sure how it got there or why it was screwing up the extract. Deleting this extraction fixed the issue, I can now proceed through the wizard to extract additional fields.

Re: Field extraction receiving error message

woodcock — Fri, 22 Nov 2019 20:27:43 GMT

Great job! Now come back here and click Accept on your answer to close the question.