topic Re: Splunk regex error: Missing terminating ] for character class in Splunk Search

Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 12:31:26 GMT

Hey Splunkers,

Noob. Trying to only retrieve the log names (ex. utility.log) after the last slash

blah\blah\blah\logs\error.log
blah\blah\blah\logs\audit.log
blah\blah\blah\logs\utility.log
blah\blah\blah\logs\service.log
blah\blah\blah\logs\servlet.log

Does anyone have any ideas as to why my regex returns the error below? Thanks all!

| rex field=source "\\\([^\\\]+)$"

Error in 'rex' command: Encountered the following error while compiling the regex '([^]+)$': Regex: missing terminating ] for character class.

P.S. The regex I am using above worked on regex 101

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 12:37:56 GMT

CORRECTION

Some text got cut out in posting
MY SPLUNK QUERY/REGEX IS THIS:

| rex field=source "\([^\]+)$"

Re: Splunk regex error: Missing terminating ] for character class

gcusello — Thu, 10 Oct 2019 13:16:36 GMT

Hi spluzer,
try this

\\(?<log_name>\w+\.\w+)$

that you can test at https://regex101.com/r/kUsfJu/1

Bye.
Giuseppe

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:05:55 GMT

Sorry, I should have been more clear. I need to capture everything after the last slash for all 5 logs.

error.log
audit.log
utility.log
service.log
servlet.log

Moreover, I couldn't get what you sent (entering the log name in individually) to work in regex 101 or splunk.

Thanks!

Re: Splunk regex error: Missing terminating ] for character class

gcusello — Thu, 10 Oct 2019 15:13:15 GMT

sorry, did you tried with

| rex field=source "\\(?<log_name>\w+\.\w+)$"

?
As you can see in regex101, it extracts all the requested filenames that are after tha last backslash.

Bye.
Giuseppe

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:31:14 GMT

Thanks. it required 3 slashes after the first quote.. and then it worked..thanks again! For some reason the 3rd slash (which I assume you posted) gets cut off when posting to the forum

| rex field=source "\(?\w+.\w+)$"

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:33:47 GMT

lol...it did it again !! THIS IS THE CORRECT ONE:

| rex field=source "\\(?\w+.\w+)$"

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:35:19 GMT

| rex field=source "\\(?\w+.\w+)$"

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:36:33 GMT

| rex field=source "\\(?\w+.\w+)$

Re: Splunk regex error: Missing terminating ] for character class

spluzer — Thu, 10 Oct 2019 15:38:38 GMT

lol...oh well i guess i cant post the correct code. it keeps getting overwritten during posting . anyway thanks Giuseppe. what you have is correct it just requires 3 slashes after the first quote