All Apps and Add-ons

Invalid regex when using `|`

boris
Path Finder

I need to capture both "D" OR "=" using (D|=).

Editing the regex of the field extractor this works:

=(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

But why does this not work?

(D|=)(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

Its returns:

Invalid regex: no named extraction at position 0 (i.e., "(D|=)(?P<F..."). Expected "(?P<variable>pattern)"
1 Solution

boris
Path Finder

Not sure why but the same regex using "(x|y)" that did not work in the Field Extractor works OK when directly done in Search:

index=main sourcetype="mapfluence" | head 10000 | rex "(%3D|=)(?P<FIELDNAME>[^=^(%3D)]+)[_.]geom" | top 50 FIELDNAME

View solution in original post

boris
Path Finder

Not sure why but the same regex using "(x|y)" that did not work in the Field Extractor works OK when directly done in Search:

index=main sourcetype="mapfluence" | head 10000 | rex "(%3D|=)(?P<FIELDNAME>[^=^(%3D)]+)[_.]geom" | top 50 FIELDNAME

dwaddle
SplunkTrust
SplunkTrust

I think it's a bug in the field extractor. It is making an assumption that every regex capturing group has a field name. The rex search command makes no such assumption.

dwaddle
SplunkTrust
SplunkTrust

Sounds like a quirk in the field extractor, assuming that every capturing group has to have a named variable to go with it. A suitable workaround might be:

[|=](?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...