topic Re: How to split a string into 2 separate fields in Splunk 6.5.0? in Splunk Search

How to split a string into 2 separate fields in Splunk 6.5.0?

HeinzWaescher — Tue, 29 Sep 2020 11:35:55 GMT

Hi,

before Splunk 6.5.0 I used commands like this to split strings into separate fields.

For fields like productId=abc_text_def

 | rex field=productId "(?<field1>.*)\_text_(?<field2>.*)"

Since 6.5.0 this does not work anymore. The error is:

Error in 'rex' command: Encountered the following error while compiling the regex '(?<field1>.*)\_text_(?<field2>.*): Regex: unrecognized character follows \

Can you help me to fix this?

Re: How to split a string into 2 separate fields in Splunk 6.5.0?

cmerriman — Tue, 25 Oct 2016 15:04:43 GMT

| rex field=productId "(?<field1>.*)_text_(?<field2>.*)"

try it without the \ does it work?

Re: How to split a string into 2 separate fields in Splunk 6.5.0?

HeinzWaescher — Tue, 25 Oct 2016 15:07:11 GMT

that was fast & easy, thanks a lot 🙂