topic Re: regex error only when saving to summary index in Splunk Search

regex error only when saving to summary index

billycote — Thu, 26 May 2016 15:58:03 GMT

This is my query.

index=snaptor sourcetype=AccessApp
| fillnull value=NULL
| eval query_string = upper(query_string)
| fields uri, productid, query_string  
| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?[.:\-\w]+(,[.:\-\w]+)*|[\w])" 
| eval syms=upper(syms) 
| eval syms = urldecode(syms) 
| rex field=syms mode=sed "s/\+/,/g"
| makemv delim="," syms 
| mvexpand syms
| stats count(uri) by productid, uri

It works fine until I try to write the results to a summary index and that's when I see this error:

Error in 'rex' command: Regex match error, please check log

The only thing I can find in the log is this:

05-26-2016 03:04:23.204 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'rex' command: Regex match error, please check log

but then again I'm not great at interpreting the log. Is there something wrong with my regex? Like I said it works outside the summary index.

Re: regex error only when saving to summary index

woodcock — Thu, 26 May 2016 16:17:23 GMT

How exactly are you "trying to write the results to a summary index"?

Re: regex error only when saving to summary index

somesoni2 — Thu, 26 May 2016 16:42:35 GMT

I don't see any fields extracted using name capturing groups in your regex ( like (?<fieldname>someregex+) ). Did you miss while copying the query OR editor truncated it?

Re: regex error only when saving to summary index

woodcock — Thu, 26 May 2016 16:49:19 GMT

I think @somesoni2 is on to something. It is quite possible that there are 2 different RegEx parsers and one (non-SI) doesn't care if you capture things without naming them but then the other one (SI) does care. In any case, try adding names like he indicates.

Re: regex error only when saving to summary index

billycote — Thu, 26 May 2016 16:57:06 GMT

Hmm... . Maybe the web doesn't like the < in there but this should have been in the original post.

| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?<syms>[.:\-\w]+(,[.:\-\w]+)*|[\w])"

Re: regex error only when saving to summary index

billycote — Thu, 26 May 2016 16:59:05 GMT

scheduled search with summary index enabled.

Re: regex error only when saving to summary index

billycote — Thu, 26 May 2016 17:19:08 GMT

| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?<syms>[.:\-\w]+(,[.:\-\w]+)*|[\w])"