Why is my rex command not working?

[rajasplunk89]

Hi all,

I am trying to extract field ABDEF-999 in the name Id. But its not extracting when I use below commands. Could someone guide on what's the mistake in following rex.

|rex field="line" "\"Testcode\":\"(?<id>[^\"]*)\""|table id

Extracting from =   \\\"Testcode\\\":\\\"ABDEF-999\\\"

[scelikok]

@rajasplunk89 ,

Sorry, Splunk needs an extra escape for backslash; 

| rex field=line "\"Testcode\S+\":\S+\"(?<id>[^\\\]+)\S+\"" | table id

[rajasplunk89]

Is there anything I can do to resolve the error?

[rajasplunk89]

Error in 'rex' command: Encountered the following error while compiling the regex '"Testcode\S+":\S+"(?<id>[^\]+)\S+"': Regex: missing terminating ] for character class

[scelikok]

Hi @rajasplunk89,

Below should work;

| rex field=line "\"Testcode\S+\":\S+\"(?<id>[^\\]+)\S+\"" | table id