What are the difference between regexp command and interactive field extractor regular expression pattern?

[royimad]

What is the differences in syntax between calling a regular expression using regexp command or using a regular expression pattern in IFX?

For example:
I have a regexp that is working well when calling:
sourcetype="mysource" | regexp _raw = "RegEx1"
But when using the IFX with the same "RegEx1" i'm getting a syntax error.

[kristian_kolb · Accepted solution]

roymiad,

You seem to have confused two concepts;

rex (and IFX) will let you extract fields from your data.

regex is quite a different thing - it's a search command that uses regular expression syntax to filter search results. It will not extract any fields.

As for the error message, the syntax for creating fields with rex (or in IFX) is;

stuff preceeding the data you want in a field (?<the field name>regex matching what you want) stuff you don't want

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

/K

[royimad]

sourcetype="online_error_log" | regex _raw = "ERROR(\s+[^\s]+){5}" this will return some field.

But editing regular expression pattern in IFX return syntax error

Invalid regex: no named extraction at position 5 (i.e., "R(\s+[^\s]..."). Expected "(?Ppattern)"

"ERROR(\s+[^\s]+){5}"

[martin_mueller]

There is no command regexp, only regex and rex.

As for the difference between regex and ifx, regex filters your events while ifx is a tool for creating field extractions (related to rex and props.conf/transforms.conf).

Concerning syntax errors, see what kristian said.

[kristian_kolb]

This could be due the various escaping you must make when entering regexes in the query.

Please provide samples.