topic Getting error in rex command while running search for DB health check report. in Splunk Search

Getting error in rex command while running search for DB health check report.

firefox95 — Wed, 02 Sep 2020 18:04:47 GMT

Hello Splunkers,

I'm working on creating a DB health check report. Idea is to get the error info when there is a failed db connection. When I'm trying to run the search below in Splunk QA I'm getting an error as Error in 'rex' command: Encountered the following error while compiling the regex '^(?<error>.*)\n?': Regex: syntax error in subpattern name (missing terminator).

Could you please help me resolve this issue? Thanks in advance.

index="_internal" sourcetype=dbx_job_metrics input_name=* connection="*" | eval event_time=strftime(_time,"%m/%d/%y %H:%M:%S") | join type=left connection [search index="_internal" sourcetype=dbx_server ERROR | rex field=_raw "^(?<error>.*)\n?" | rex field=error "/api/connections/(?<connection>[^/]+)"] | stats latest(event_time) as event_time latest(host) as HF latest(connection) as connection latest(status) as status latest(error) as error by input_name | sort - status

Re: Splunk- Error in 'rex' command while running search

gcusello — Wed, 02 Sep 2020 08:23:07 GMT

Hi @firefox95,

the first regex isn't so clear for me, because it seems that you take with the first regex all the _raw and with the second a part of it, so why you extracted twice?

could you share an example of your logs?

Then when you insert codes please use the "Insert/Edit Code Sample" button (the one with "</>").

At least why do you use Join between in a search on the same index? remember that there's the limit of 50,000 results in subsearches, maybe it's possible to run a simpler search.

Ciao.

Giuseppe

Re: Splunk- Error in 'rex' command while running search

Nisha18789 — Wed, 02 Sep 2020 08:26:11 GMT

hi @firefox95 , if you are using this search for a report , please use below

index="_internal" sourcetype=dbx_job_metrics input_name=* connection="*"
| eval event_time=strftime(_time,"%m/%d/%y %H:%M:%S")
| join type=left connection [search index="_internal" sourcetype=dbx_server ERROR
| rex field=_raw "^(?<error>.*)\n?"
| rex field=error "/api/connections/(?<connection>[^/]+)"]
| stats latest(event_time) as event_time latest(host) as HF latest(connection) as connection latest(status) as status latest(error) as error by input_name
| sort - status