Splunk Enterprise

Cannot save custom field extraction when using my own regex

Julznova_
New Member

Hey, 

I'm attempting to extract a field by using: 

 

(?<=cs4=)(.*\n?)(?=categoryTechnique)

 

It matches 100% of the results, also checked on a regex editor,  but I cannot hit the save button. It continues to be greyed out.
sssss.JPG

I've attempted to create a custom field in Settings > Fields > Field Extractions > Add New

For this source type, but that throws up errors.

Anyone give me a hand?

Thanks!

 

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Julznova_ 

Following is the error, What are you trying to extract and any sample?

Error in 'rex' command: The regex '(?<=cs4=)(.*\n?)(?=categoryTechnique)' does not extract anything. It should specify at least one named group. Format: (?<name>...).

 

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...