All Apps and Add-ons

What are the difference between regexp command and interactive field extractor regular expression pattern?

royimad
Builder

What is the differences in syntax between calling a regular expression using regexp command or using a regular expression pattern in IFX?

For example:
I have a regexp that is working well when calling:
sourcetype="mysource" | regexp _raw = "RegEx1"
But when using the IFX with the same "RegEx1" i'm getting a syntax error.

0 Karma
1 Solution

kristian_kolb
Ultra Champion

roymiad,

You seem to have confused two concepts;

rex (and IFX) will let you extract fields from your data.

regex is quite a different thing - it's a search command that uses regular expression syntax to filter search results. It will not extract any fields.

As for the error message, the syntax for creating fields with rex (or in IFX) is;

stuff preceeding the data you want in a field (?<the field name>regex matching what you want) stuff you don't want

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

/K

View solution in original post

kristian_kolb
Ultra Champion

roymiad,

You seem to have confused two concepts;

rex (and IFX) will let you extract fields from your data.

regex is quite a different thing - it's a search command that uses regular expression syntax to filter search results. It will not extract any fields.

As for the error message, the syntax for creating fields with rex (or in IFX) is;

stuff preceeding the data you want in a field (?<the field name>regex matching what you want) stuff you don't want

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

/K

royimad
Builder

sourcetype="online_error_log" | regex _raw = "ERROR(\s+[^\s]+){5}" this will return some field.

But editing regular expression pattern in IFX return syntax error

Invalid regex: no named extraction at position 5 (i.e., "R(\s+[^\s]..."). Expected "(?Ppattern)"

"ERROR(\s+[^\s]+){5}"

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There is no command regexp, only regex and rex.

As for the difference between regex and ifx, regex filters your events while ifx is a tool for creating field extractions (related to rex and props.conf/transforms.conf).

Concerning syntax errors, see what kristian said.

kristian_kolb
Ultra Champion

This could be due the various escaping you must make when entering regexes in the query.

Please provide samples.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...