Splunk Enterprise

Why does my rex not work on splunk?

SplunkEmp22
Engager

Hi, i don't know where is the problem. The search it's:

| rex '(?<field>H.+)\\'

| table field

I want to use regular express. for parsing field and i want to show in output the result.  The field got a path like \Pc\Hardware\Nice\ok . I want to get all of the words after Pc\. 

I don't know how to solve, he literaly does nothing and return the same origin data.

Thank u

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You have to double-up on backslashes in Splunk regex - compared to something that works in regex101.com for example

| rex "(?<field>H.+)\\\\"

View solution in original post

SplunkEmp22
Engager

Top bro. I'm learning from regex101, so i didn't know that. Thank u man

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have to double-up on backslashes in Splunk regex - compared to something that works in regex101.com for example

| rex "(?<field>H.+)\\\\"
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...