- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Error in 'rex' command: Invalid argument: ' ' -- How do I fix this issue?

russell120
Communicator
08-19-2019
11:46 AM
Hi, I have a daily search that suddenly stopped working (upgraded from 6.7 to 7.1 before it stopped working, I believe):
|inputlookup my_file.csv
|eval shared_sources="master_source"
|append
[search sourcetype="my_sourcetype"
|fields someIPs host
|dedup someIPs
|rex field=host mode=sed "s/\..*$//"
|rename someIPs as ip
|rename host as host_my_sourcetype
|eval shared_sources="my_sourcetype"]
What's the issue with my rex command?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
08-19-2019
12:59 PM
Upgrade to the latest maintenance release; there is nothing wrong with your rex
.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

russell120
Communicator
08-19-2019
01:02 PM
Just verified that the version we're using is 7.1.7. Is there any indication on what maintenance release we currently have in the Splunk version?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

oscar84x
Contributor
08-19-2019
12:57 PM
Does the sub-search work if you run it by itself or do you get the same error?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

russell120
Communicator
08-19-2019
01:00 PM
@oscar84x I still get the same error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mayurr98
Super Champion
08-19-2019
12:08 PM
could you provide sample test values for the host?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

russell120
Communicator
08-19-2019
12:29 PM
@mayurr98 Sure, they're all in this format: GHRCEDC4BA.ghij.def.abc
