topic Re: rex error help in Splunk Search

rex error help

ilove275 — Wed, 21 May 2014 07:07:17 GMT

The regular expression is correct according to RegExr, but i keep on getting this error

Error in 'rex' command: Encountered the following error while compiling the regex 'count(domain)=(?<count(domain)>.*)': Regex: syntax error in subpattern name (missing terminator)

Here is what i have in Splunk Search:

rex field=_raw "count(domain)=(?<count(domain)>.*)"

Thanks guys

Re: rex error help

MuS — Wed, 21 May 2014 07:23:17 GMT

can you provide some sample events please?

Re: rex error help

rakesh_498115 — Wed, 21 May 2014 07:51:32 GMT

Hi ilove275,

brackets inside the rex field name cause the syntax issue.changing the field name count(domain) to domain_count would help u solving the issue.

rex field=_raw "count\(domain\)=(?<domain_count>.*)"

Thanks.

Re: rex error help

ilove275 — Mon, 28 Sep 2020 16:40:57 GMT

sample log

05/20/2014 00:00:00 +0900, search_name=AAAAA, search_now=1400606400.000, info_min_time=1400511600.000, info_max_time=1400598000.000, info_search_time=1400606401.123, count(domain)=744788, date_wday=tuesday
Thanks

Re: rex error help

MuS — Wed, 21 May 2014 07:59:22 GMT

and don't forget to append a " at the end of the regex command

Re: rex error help

ilove275 — Mon, 28 Sep 2020 16:41:00 GMT

field name's "count(domain)" not "domain_count"

My Splunk Search
index="AAAA" source="BBBB" | rex field=_raw "count(domain)=(?.) date_wday=(?.)" | table date_wday count(domain)

error
Error in 'rex' command: Encountered the following error while compiling the regex 'count(domain)=(?.) date_wday=(?.)': Regex: syntax error in subpattern name (missing terminator)

Thanks rakesh_498115

Re: rex error help

ilove275 — Wed, 21 May 2014 14:51:33 GMT

it doesn't come out the File name "domain_count" when I use "Rename" commamd

Re: rex error help

somesoni2 — Wed, 21 May 2014 20:22:35 GMT

Try this (run anywhere)

 index="AAAA" source="BBBB" | rex field=_raw "count\(domain\)=(?<domain_count>.*)," | rename domain_count as count(domain)

Re: rex error help

ilove275 — Thu, 22 May 2014 00:05:00 GMT

Thanks for your help
^^

Re: rex error help

chimell — Sun, 11 Dec 2016 15:44:28 GMT

hi
try this search code :

...................................|rex field=_raw "count\(domain\)\=(?<count_domain>[^\,]+)"|table count_domain