Using rex simple-xml with javascript extensions

[bmacias84]

Hello,

I am running into a problem where I am attempting to use rex command similar to the Custom Chart Overlay in Simple XML examples.

I know my search works in simple xml.

earliest=-2hr latest=now

| fields time_taken, cs_uri_stem, sc_status

| rex field=sc_status \"(?<200>2\d\d)\"

 |rex field=sc_status \"(?<300>3\d\d)\"

| rex field=sc_status \"(?<400>4\d\d)\"

| rex field=sc_status \"(?<500>5\d\d)\"

| rex field=cs_uri_stem \"(?<uri>/[\w\d]{0,13})\"

| eval uri=lower(uri) |bucket _time span=2m

| stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri

but in the following it doesnt

            <div id="base-search"

                 class="splunk-manager"

                 data-require="splunkjs/mvc/searchmanager"

                 data-options='{

                    "earliest_time": "-2@h",

                    "latest_time": "now",

                    "cache": "60",

                    "search": ".... earliest=-2hr latest=now

                                | fields time_taken, cs_uri_stem, sc_status

                                | rex field=sc_status \"(?&lt ;200&gt ;2\d\d)\"

                                | rex field=sc_status \"(?&lt ;300&gt ;3\d\d)\"

                                | rex field=sc_status \"(?&lt ;400&gt ;4\d\d)\"

                                | rex field=sc_status \"(?&lt ;500&gt ;5\d\d)\"

                                | rex field=cs_uri_stem \"(?&lt ;uri&gt ;/[\w\d]{0,13})\"

                                | eval uri=lower(uri) |bucket _time span=2m

                                | stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri"

                 }'>

What gives?

Thanks in advance

[lukeh]

mathu has it, you have to use a backslash to escape the double quotes.

I also had to escape the existing backslashes in my regex:

| rex field=cst_ls_segment \"LS\\d+\\s+(?<segment>.*)\"

Cheers,

Luke.

[bmacias84]

I would post the job inspector, but as soon I add regex it never makes it to the search manager.

[mathu]

can you post the resulting search (from the job inspector)?

[bmacias84]

Sorry I forgot to added the double backslash. The part that having problems is the rex extraction. It does nots like the html encoding of the greater/ less than symbols or the symbol.

[mathu]

Use a backslash to escape the double quotes.
Single quotes don't work because of "data-options" which is already quoted with singles.

[martin_mueller]

Make sure you either escape the double quotes within the search string or use single quotes around it instead.