Splunk Enterprise

Cannot save custom field extraction when using my own regex

Julznova_
New Member

Hey, 

I'm attempting to extract a field by using: 

 

(?<=cs4=)(.*\n?)(?=categoryTechnique)

 

It matches 100% of the results, also checked on a regex editor,  but I cannot hit the save button. It continues to be greyed out.
sssss.JPG

I've attempted to create a custom field in Settings > Fields > Field Extractions > Add New

For this source type, but that throws up errors.

Anyone give me a hand?

Thanks!

 

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Julznova_ 

Following is the error, What are you trying to extract and any sample?

Error in 'rex' command: The regex '(?<=cs4=)(.*\n?)(?=categoryTechnique)' does not extract anything. It should specify at least one named group. Format: (?<name>...).

 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...