topic Re: Why am I getting "Error in 'rex' command...Regex: missing )"? in Splunk Search

Why am I getting "Error in 'rex' command...Regex: missing )"?

splunker1981 — Wed, 09 Sep 2015 15:02:54 GMT

Hello All,

I am brand new to Splunk and can't for the life of me figure out what I am doing wrong. I would like to pull the following data from raw text (about 10 lines of so of raw text), extract to a new field and then replace data in that field from paren number paren with a period. So (number) with .

Sample data
(1)dkfj(10)dkeiieii(2)ljflkkldj(3)
(2)datadata(1)dta(10)dat(2)
(8)sample(3)sample(0)

I am using the following command in Splunk, but when I try to display the results, I get blank data:

tag=unencoded | rex "(?<formatEncode>(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))" | rex mode=sed field=formatEncode "s/([0-9])/./g"  | stats by formatEncode

I tested the regex and the sed substitution and both work just fine. I get the following error when I try to run it in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(?<formatEncode<(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))': Regex: missing )

Any help or pointer would be greatly appreciated.

Thanks in advance.

Re: Why am I getting "Error in 'rex' command...Regex: missing )"?

dkoops — Wed, 09 Sep 2015 15:16:34 GMT

Looks like you are missing a bracket at the end of your first rex command.

Re: Why am I getting "Error in 'rex' command...Regex: missing )"?

somesoni2 — Wed, 09 Sep 2015 15:39:15 GMT

I'm assuming your sample data in question is showing data to be extracted from 3 different events.
You Sample data has variable number of strings (enclosed between numbers). Is that correct? Could you post full raw event as well?

Re: Why am I getting "Error in 'rex' command...Regex: missing )"?

splunker1981 — Wed, 09 Sep 2015 15:44:20 GMT

Actually that was the issue, thanks.

For those trying to do something similar here is the command I used

rex "(?(\(\d+\))([A-Za-z0-9_\-]+\(\d+\))+\w+(\(\d+\)))" | rex mode=sed field=formatEncode "s/\([0-9]\)/./g" | stats by formatEncode