All Apps and Add-ons
Highlighted

What are the difference between regexp command and interactive field extractor regular expression pattern?

Builder

What is the differences in syntax between calling a regular expression using regexp command or using a regular expression pattern in IFX?

For example:
I have a regexp that is working well when calling:
sourcetype="mysource" | regexp _raw = "RegEx1"
But when using the IFX with the same "RegEx1" i'm getting a syntax error.

0 Karma
Highlighted

Re: What are the difference between regexp command and interactive field extractor regular expression pattern?

Ultra Champion

This could be due the various escaping you must make when entering regexes in the query.

Please provide samples.

0 Karma
Highlighted

Re: What are the difference between regexp command and interactive field extractor regular expression pattern?

SplunkTrust
SplunkTrust

There is no command regexp, only regex and rex.

As for the difference between regex and ifx, regex filters your events while ifx is a tool for creating field extractions (related to rex and props.conf/transforms.conf).

Concerning syntax errors, see what kristian said.

Highlighted

Re: What are the difference between regexp command and interactive field extractor regular expression pattern?

Builder

sourcetype="onlineerrorlog" | regex _raw = "ERROR(\s+[^\s]+){5}" this will return some field.

But editing regular expression pattern in IFX return syntax error

Invalid regex: no named extraction at position 5 (i.e., "R(\s+[^\s]..."). Expected "(?Ppattern)"

"ERROR(\s+[^\s]+){5}"

0 Karma
Highlighted

Re: What are the difference between regexp command and interactive field extractor regular expression pattern?

Ultra Champion

roymiad,

You seem to have confused two concepts;

rex (and IFX) will let you extract fields from your data.

regex is quite a different thing - it's a search command that uses regular expression syntax to filter search results. It will not extract any fields.

As for the error message, the syntax for creating fields with rex (or in IFX) is;

stuff preceeding the data you want in a field (?<the field name>regex matching what you want) stuff you don't want

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

/K

View solution in original post