topic Re: Rex command issue in splunk views in Splunk Search

Rex command issue in splunk views

iamniks — Mon, 28 Sep 2020 11:54:32 GMT

Hi,

i am using the below search command in a splunk view as given below.

index=re sourcetype="clearcase_Log" "Trouble opening VOB database" earliest=-7d |rex field=_raw ".vbstore/(?.).vbs" |
stats count as "ERROR INSTANCES" by vob

is causing trouble as we have to place search query inside tags. I tried to use < and > for < and > respectively which failed too. Can you please help me with the below error?

***Error in 'rex' command: Encountered the following error while compiling the regex '.*vbstore/(?
.).vbs': Regex: unrecognized character after (? or (?-****

Re: Rex command issue in splunk views

iamniks — Wed, 06 Jun 2012 07:15:33 GMT

i mean i tried to use (without spaces)
"& l t ;" for < and "& g t ;" for > but failed

Re: Rex command issue in splunk views

Ayn — Wed, 06 Jun 2012 08:01:19 GMT

When you're enclosing the tags that are causing you trouble in an XML document, they are interpreted as part of the XML data rather than as part of the rex command. To specify that these tags are not referring to the XML structure, use the special escaping sequence "<![CDATA[" at the beginning of your string and its corresponding end sequence "]]>" at the end. Example here: http://splunk-base.splunk.com/answers/30157/inputlookup-in-view-with-rex

Re: Rex command issue in splunk views

iamniks — Wed, 06 Jun 2012 09:18:03 GMT

Error in 'rex' command: Encountered the following error while compiling the regex '.vbstore/(? .).vbs': Regex: unrecognized character after (? or (?-**

Re: Rex command issue in splunk views

iamniks — Wed, 06 Jun 2012 09:19:29 GMT

doesnt work for CDATA also

Re: Rex command issue in splunk views

Ayn — Wed, 06 Jun 2012 09:23:43 GMT

Are you using a space after the ( character? You shouldn't, it's incorrect syntax and would cause Splunk to throw that error.

Re: Rex command issue in splunk views

Ayn — Wed, 06 Jun 2012 09:24:58 GMT

Also your extraction probably doesn't extract what you want. You likely want .vbstore/(?<vob>.+?)\.vbs

Re: Rex command issue in splunk views

iamniks — Wed, 06 Jun 2012 09:28:43 GMT

This works now.. grt thank you . I had left an extra special char.

Re: Rex command issue in splunk views

Ayn — Wed, 06 Jun 2012 09:33:28 GMT

Awesome. Could you please mark my answer as accepted? Thanks!