topic Re: regex (Invalid regex: no named extraction at position 5 ) in Splunk Search

regex (Invalid regex: no named extraction at position 5 )

broman — Thu, 12 Feb 2015 14:56:38 GMT

I have problem with saving regex for extracting class name
Here is my regex

(?i)\[([0-9a-zA-Z\.\s\-]&ast;(\[[0-9]&ast;\])?[0-9a-zA-Z\.\s\-\/]&ast;)\]\s(?P<FIELDNAME>[^ ]+)

And here is log sample
12.02.2015 12:14:16.946 INFO [10.36.27.187 [1423743256597] GET /content/company/global/en/company/notices/polish.html HTTP/1.1] com.company.web.core.cdn.CDNTransformer CDN: http://static-dc.company.net
12.02.2015 14:17:03.340 INFO [pool-5-thread-3] org.apache.jackrabbit.core.state.SharedItemStateManager Validating change-set hierarchy

And here is splunk error
"Invalid regex: no named extraction at position 5 (i.e., "[([0-9a-zA..."). Expected "(?P<variable>pattern)""

Re: regex (Invalid regex: no named extraction at position 5 )

cphair — Thu, 12 Feb 2015 15:00:36 GMT

You'll need to fix the formatting on your regex so it displays properly in the browser; we can't read it as is. Edit your question and substitute & # 92; (with no spaces) for all the backslashes.

Re: regex (Invalid regex: no named extraction at position 5 )

broman — Thu, 12 Feb 2015 15:16:18 GMT

done, thanks for notice

Re: regex (Invalid regex: no named extraction at position 5 )

richgalloway — Thu, 12 Feb 2015 15:24:02 GMT

The forward slash needs to be escaped.

You have nested capturing groups. Is that intentional?

Re: regex (Invalid regex: no named extraction at position 5 )

broman — Thu, 12 Feb 2015 15:28:06 GMT

in some log lines I have nested [] so I try to handle this in regex.

Re: regex (Invalid regex: no named extraction at position 5 )

richgalloway — Thu, 12 Feb 2015 15:35:07 GMT

This regex string works with your example log entries on regex101.com. It also handles nested brackets.

\[.*\]\s(?P<FIELDNAME>[^ ]+)

Re: regex (Invalid regex: no named extraction at position 5 )

broman — Thu, 12 Feb 2015 15:38:36 GMT

Thanks 😄