topic Re: How do I write the regular expression to extract fields separated by a backslash? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222789#M65533 <P>That error message usually means an escape character is missing. The board messed up your regex string, however, so it's impossible to tell where the error might be. Please re-post your entire <CODE>rex</CODE> command by enclosing it within backtics.</P> Tue, 10 Nov 2015 15:01:18 GMT richgalloway 2015-11-10T15:01:18Z How do I write the regular expression to extract fields separated by a backslash? https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222786#M65530 <P>Hi Community,</P> <P>I'm struggling with a regex expression. I'm trying to extract fields (seperated by <CODE>\</CODE>) into the three new fields. I tried the following but with no luck:</P> <PRE><CODE>Data: \ValueA\ValueB\ValueC\ValueD... RegEx: rex field=InputField "\\(?&lt;Output1&gt;.*)\\(?&lt;Output2&gt;.*)\\(?&lt;Output3&gt;.*)\\" </CODE></PRE> Mon, 09 Nov 2015 16:26:05 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222786#M65530 macoo 2015-11-09T16:26:05Z Re: How do I write the regular expression to extract fields separated by a backslash? https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222787#M65531 <P>Regex101.com successfully parses your sample data with regex string you provided. What results are you getting and what are you expecting?</P> Mon, 09 Nov 2015 17:39:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222787#M65531 richgalloway 2015-11-09T17:39:30Z Re: How do I write the regular expression to extract fields separated by a backslash? https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222788#M65532 <P>Well, it works in regex101.com but fail in Splunk with the following error:</P> <P>Error in 'rex' command: <CODE>Encountered the following error while compiling the regex '\(?.*)\(?.*)\(?.*)\': Regex: unmatched parentheses</CODE></P> Tue, 10 Nov 2015 09:06:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222788#M65532 macoo 2015-11-10T09:06:15Z Re: How do I write the regular expression to extract fields separated by a backslash? https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222789#M65533 <P>That error message usually means an escape character is missing. The board messed up your regex string, however, so it's impossible to tell where the error might be. Please re-post your entire <CODE>rex</CODE> command by enclosing it within backtics.</P> Tue, 10 Nov 2015 15:01:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regular-expression-to-extract-fields/m-p/222789#M65533 richgalloway 2015-11-10T15:01:18Z