topic Why am I getting this error when using regex for URI search? in Splunk Search

Why am I getting this error when using regex for URI search?

ghildiya — Thu, 30 Jul 2020 04:49:10 GMT

I have the following query to search results which contain a specific rest endpoint which has a UUID path parameter:

.... | regex requestURI="/baseurl/\b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b

But it seems to be wrong. Error is :

Unknown search command '0'.

What is the mistake I am making here?

Re: Using regex for URI search

richgalloway — Wed, 29 Jul 2020 17:19:48 GMT

Splunk appears to be interpreting part of your regular expression as a subsearch. Make sure the expression is enclosed in quotation marks and any embedded quotation marks are escaped.

Re: Using regex for URI search

ghildiya — Thu, 30 Jul 2020 02:51:35 GMT

I tried this:

.... | regex requestURI=*/baseurl/\"[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\"*

But this too doesn't work.

Re: Using regex for URI search

richgalloway — Thu, 30 Jul 2020 12:45:37 GMT

The regex command is still missing the enclosing quotation marks.