Does Splunk support rex in macros?

[Splunk_God]

I'm receiving the following error: Error in 'rex' command: Encountered the following error while compiling the regex ''(?P.(.{2': Regex: missing ). Am i doing something wrong? Here is the macro entry:

[Testing]
definition=rex field=file '(?P\.(.{2,4})$)' 

[MuS · Accepted solution]

Hi Splunk_God,

take a look at this macro which ships in Splunk 6.2:

[audit_rexsearch]
definition = rex "search='(?<search>.*?)', autojoin"

it uses " instead of your ' so changing the macro to

[Testing]
 definition=rex field=file "(?P\.(.{2,4})$)"

should do the trick.

Hope this helps ...

cheers, MuS