Splunk Search

Field extraction receiving error message

atatistcheff
Explorer

Any time I try using the Extract Field option in an event list the next page returns this error:

Error in 'rex' command:

The regex '//' does not extract anything. It should specify at least one named group. Format: (?...).

This used to work but it's been a few months since I tried it. I'm not doing anything special as you can see. The regex is just // yet it returns nothing. I tried restarting Splunk but I think something is broken somewhere.

0 Karma
1 Solution

atatistcheff
Explorer

I found the problem, there was a field extraction saved with just // in the regex. Not sure how it got there or why it was screwing up the extract. Deleting this extraction fixed the issue, I can now proceed through the wizard to extract additional fields.

alt text

View solution in original post

atatistcheff
Explorer

I found the problem, there was a field extraction saved with just // in the regex. Not sure how it got there or why it was screwing up the extract. Deleting this extraction fixed the issue, I can now proceed through the wizard to extract additional fields.

alt text

woodcock
Esteemed Legend

Great job! Now come back here and click Accept on your answer to close the question.

0 Karma

atatistcheff
Explorer

Thanks for the answer but I have no way to mention a field name. To be clear, all i'm doing is clicking the Extract Fields option in the event and getting an error. Please see the screenshots below.

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

The screenshots are not attached.

0 Karma

atatistcheff
Explorer

Sorry, I'm not good at attaching. See if you can find them here.

alt text
alt text

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

In which Splunk Version you are getting this error?

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

According to me, you have to mention field name in rex, which you can use further,
like (?<Name>//)

Please refer doc for more info:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...