Dashboards & Visualizations

Error in 'where' command:Regex:quantifier does not follow a repeatable item

Neel88
Explorer

| loadjob savedsearch="nobody:splunk_fcr_evo:monitoring"
| table adt, FLOW, Date, NbRecordsOKFCR, Total, NbRecords, NBFile, NA1, NA2, NA3, CM, Alert
| where match(FLOW, "$Flow_token$") and match(adt, "$adt_token$") $filter_green_lights$
| fields adt FLOW Date NA1, NA2, NA3,CM, "Total" | sort adt, Date

Labels (5)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What values do you have in your tokens?

0 Karma

Neel88
Explorer

Different values in TEXT, Duplicate values and special character ( / and _ ) only.

0 Karma

Neel88
Explorer

Its like this- 

DateFLOWadt
01/01/2023A_1aa/b
01/01/2023A_1aa/c
01/01/2023A_1aad
01/01/2023A_1aae
01/01/2023A_1aa/f
01/01/2023A_1aag
01/01/2023A_1aah
01/01/2023A_1aa/i
01/01/2023A_1aaj
02/01/2023A_1aa/b
02/01/2023A_1aa/c
02/01/2023A_1aad
02/01/2023A_1aae
02/01/2023A_1aa/f
02/01/2023A_1aag
02/01/2023A_1aah
02/01/2023A_1aa/i
02/01/2023A_1aaj
01/01/2023FNa
01/01/2023FNb
01/01/2023FNc
01/01/2023FNd
01/01/2023FNe
01/01/2023FNg
01/01/2023FNh
01/01/2023FNi
02/01/2023FNa
02/01/2023FNb
02/01/2023FNc
02/01/2023FNd
02/01/2023FNe
02/01/2023FNg
02/01/2023FNh
02/01/2023FNi
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You may have to escape the slash with a backslash e.g. 01\/01\/2023 although this is not a quantifier, for that you are looking for + or * or {1} for example. Please check all the values you have in your tokens.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...