Splunk Search

Error in 'rex' command: Invalid argument: ' ' -- How do I fix this issue?

Communicator

Hi, I have a daily search that suddenly stopped working (upgraded from 6.7 to 7.1 before it stopped working, I believe):

|inputlookup my_file.csv
|eval shared_sources="master_source"
|append
   [search sourcetype="my_sourcetype" 
    |fields someIPs host
    |dedup someIPs 
    |rex field=host mode=sed "s/\..*$//"
    |rename someIPs as ip
    |rename host as host_my_sourcetype
    |eval shared_sources="my_sourcetype"]

What's the issue with my rex command?

Tags (3)
0 Karma

Esteemed Legend

Upgrade to the latest maintenance release; there is nothing wrong with your rex.

0 Karma

Communicator

Just verified that the version we're using is 7.1.7. Is there any indication on what maintenance release we currently have in the Splunk version?

0 Karma

Contributor

Does the sub-search work if you run it by itself or do you get the same error?

0 Karma

Communicator

@oscar84x I still get the same error

0 Karma

SplunkTrust
SplunkTrust

could you provide sample test values for the host?

0 Karma

Communicator

@mayurr98 Sure, they're all in this format: GHRCEDC4BA.ghij.def.abc

0 Karma