All Apps and Add-ons

Invalid regex when using `|`

boris
Path Finder

I need to capture both "D" OR "=" using (D|=).

Editing the regex of the field extractor this works:

=(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

But why does this not work?

(D|=)(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

Its returns:

Invalid regex: no named extraction at position 0 (i.e., "(D|=)(?P<F..."). Expected "(?P<variable>pattern)"
1 Solution

boris
Path Finder

Not sure why but the same regex using "(x|y)" that did not work in the Field Extractor works OK when directly done in Search:

index=main sourcetype="mapfluence" | head 10000 | rex "(%3D|=)(?P<FIELDNAME>[^=^(%3D)]+)[_.]geom" | top 50 FIELDNAME

View solution in original post

boris
Path Finder

Not sure why but the same regex using "(x|y)" that did not work in the Field Extractor works OK when directly done in Search:

index=main sourcetype="mapfluence" | head 10000 | rex "(%3D|=)(?P<FIELDNAME>[^=^(%3D)]+)[_.]geom" | top 50 FIELDNAME

dwaddle
SplunkTrust
SplunkTrust

I think it's a bug in the field extractor. It is making an assumption that every regex capturing group has a field name. The rex search command makes no such assumption.

dwaddle
SplunkTrust
SplunkTrust

Sounds like a quirk in the field extractor, assuming that every capturing group has to have a named variable to go with it. A suitable workaround might be:

[|=](?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...