topic Re: Regex works on regex101 but not splunk in Splunk Search

Regex works on regex101 but not splunk

syk19567 — Fri, 09 Feb 2024 16:39:35 GMT

Hi community,

I'm using rex to get some strings.

The log is like

\"submission_id\":337901

The regex I'm using is:

\"submission_id\\\":(?<subID>\d+)

It works well on regex101:
https://regex101.com/r/Usr7Ki/1

However, in Splunk, it doesn't find anything.
The command is (just added double quotes to wrap the regex)

rex "\"submission_id\\\":(?<subID>\d+)"

Any ideas and suggestions are appreciated!

Re: Regex works on regex101 but not splunk

ITWhisperer — Fri, 09 Feb 2024 16:46:45 GMT

You need to double up on some of your backslashes

| rex "\\\"submission_id\\\\\":(?<subID>\d+)"

Essentially, the rex command goes through a extra step of string parsing so backslashes have to be escaped an extra time

Re: Regex works on regex101 but not splunk

gcusello — Fri, 09 Feb 2024 16:53:06 GMT

Hi @syk19567,

it's a bug that I requested to solve for one of our biggest customers:

if you tested a regex containing a backslas in regex101 and it runs, to use this regex in a search you have to add other two backslashes to each backslash.

If instead you want to use this regex in a field extraction, you have to use the regex from regex1010 (the one with one backslash).

so the regex to use in a search is:

| rex "\\\\\"submission_id\\\\\":(?<submission_id>\d+)"

instead the regex to use in the extract field (and regex101) is

\\\"submission_id\\\":(?P<submission_id>\d+)

In addition, if you try to use the IFX on the same sourcetype, you have an error and you cannot use IFX.

As I said, I asked to solve this bug but they didn't give me a date.

Ciao.

Giuseppe

Re: Regex works on regex101 but not splunk

syk19567 — Fri, 09 Feb 2024 16:53:21 GMT

This blows my mind and I'm kinda lost. But this really works!! Thank you!

Re: Regex works on regex101 but not splunk

isoutamo — Fri, 09 Feb 2024 16:55:15 GMT

Rule of thumb in splunk with rex. Add \-characters until it works 😉

Re: Regex works on regex101 but not splunk

syk19567 — Fri, 09 Feb 2024 17:31:28 GMT

Thank you Giuseppe, this is very informative!