topic No regex could be learned. Try providing different examples or restriction. in Splunk Search

No regex could be learned. Try providing different examples or restriction.

hikari992 — Thu, 02 May 2013 03:47:13 GMT

Hi everyone, I'm quite new to splunk.
I encounter this error message "No regex could be learned. Try providing different examples or restriction." while I was trying to extract longitude value using the Interactive field extractor. But I was able to extract Latitude value and this is the regex for the Latitude value that display in the props.conf file "EXTRACT-Latitude = (?i).Double">(?P[^<]+)". Please help me. Thank you.

Re: No regex could be learned. Try providing different examples or restriction.

Ayn — Thu, 02 May 2013 06:43:57 GMT

Log samples please? Hard to tell you what your regular expression should look like otherwise.

Re: No regex could be learned. Try providing different examples or restriction.

hikari992 — Thu, 02 May 2013 07:12:24 GMT

Hi, it's a xml data.
1.4004771683629058/d:Latitude
103.8579338813216/d:Longitude

Re: No regex could be learned. Try providing different examples or restriction.

Ayn — Thu, 02 May 2013 09:54:20 GMT

Just use the Latitude extraction as a template here, change latitude for longitude in both places and you should be good to go.

Re: No regex could be learned. Try providing different examples or restriction.

kristian_kolb — Thu, 02 May 2013 12:22:27 GMT

Problem is that the EXTRACT in the original question would capture both long and lat, calling them both latitude (or just keeping one of them if it's not a multi-valued field).

Re: No regex could be learned. Try providing different examples or restriction.

Ayn — Thu, 02 May 2013 14:10:25 GMT

Oh, right. Didn't see that 🙂

Re: No regex could be learned. Try providing different examples or restriction.

kristian_kolb — Thu, 02 May 2013 14:58:04 GMT

1.4004771683629058/d:latitude
103.8579338813216/d:longitude

Given the data format above, I would choose to do like so;

props.conf

[your_sourcetype]
EXTRACT-lat = >(?<latitude>[^<]+)</d:latitude
EXTRACT-long = >(?<longitude>[^<]+)</d:longitude