topic Re: What is wrong with my regex? "Regex: missing terminating ] for character class" in Splunk Search

What is wrong with my regex? "Regex: missing terminating ] for character class"

dbcase — Tue, 28 Nov 2017 19:41:30 GMT

Hi,

I have this data
{"analyticType":"CustomAnalytic","buildTarget":"blah","clientSessionId":"DXFMLAF-CYTQQQK","Properties":{"index":1,"args":["{\"accountId\":\"exr244040\",\"customerId\":\"1001857\"}"],"category":"Event"}}

And this regex (which works in regex101

accountId\\":\\"(?<extref>[^\\]+)

but splunk barfs when I use it in this query

index=wholesale_app CustomAnalytic Properties.index=1|rex "accountId\\":\\"(?<extref>[^\\]+)"|stats count by extref

with this error message

Error in 'rex' command: Encountered the following error while compiling the regex 'accountId\:\(?<extref>[^\]+)': Regex: missing terminating ] for character class

(scratches head).....what am I doing wrong?

Re: What is wrong with my regex? "Regex: missing terminating ] for character class"

DalJeanis — Tue, 28 Nov 2017 20:34:10 GMT

Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.

Here's run-anywhere code...

| makeresults 
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."

| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"

updated from

| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"

In this case, I used this construct [\\\\] to represent a single escape character \ , and the construct [\\\"] to represent a single quote ".

Re: What is wrong with my regex? "Regex: missing terminating ] for character class"

dbcase — Tue, 28 Nov 2017 20:34:15 GMT

Figured it out, splunk requires more escaping of slash characters

Re: What is wrong with my regex? "Regex: missing terminating ] for character class"

dbcase — Tue, 28 Nov 2017 20:35:24 GMT

thanks DalJeanis!

I ended up with

rex "accountId.....(?<extref>[^\\\]+)"

Re: What is wrong with my regex? "Regex: missing terminating ] for character class"

DalJeanis — Tue, 28 Nov 2017 20:45:55 GMT

Good job. Updated to the simpler version.

Re: What is wrong with my regex? "Regex: missing terminating ] for character class"

becksyboy — Tue, 20 Dec 2022 14:19:09 GMT

Thanks this worked for me