Splunk Search

Error in 'rex' command: Regex: quantifier does not follow a repeatable item

AshimaE
Explorer

On using regex one by one to replace two types of strings its is giving the following error. Also while using the replace twice it is giving the error
Error in 'rex' command: Regex: quantifier does not follow a repeatable item

Any way to work around this.
My query looks like the following

index=abc sourcetype=def "pushed to the connector." | rex field=message "Message to \'(?<push>.*)\' pushed to the connector." | rex field=push mode=sed "s/ //g" | rex field=push mode=sed "s/+//g" | table message push

And for replace it is

index=abc sourcetype=def "pushed to the connector." | rex field=message "Message to \'(?<push>.*)\' pushed to the connector." |  eval final=trim(replace(push," ","")) | eval final2=replace(final,"+","") | table message push final final2

How to work around this issue.

0 Karma

niketn
Legend

@AshimaE, you need to escape plus sign in second replace with slash. Please refer to the modifications below

index=abc sourcetype=def "pushed to the connector." 
| rex field=message "Message to \'(?<push>[^'].*)\' pushed to the connector." 
| eval final=replace(replace(push," ",""),"\+","") 
| table message push final
  • You dont need trim() since replace is doing the same.
  • Replace can be cascaded.
  • For RegEx I have added [^'] which says find everything (refer to regex101.com for details) except single quote which currently marks the end of extracted field pushed.
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@AshimaE, can you please test and confirm whether the suggested change worked for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...