How do I write the regular expression to extract fields separated by a backslash?

[macoo]

Hi Community,

I'm struggling with a regex expression. I'm trying to extract fields (seperated by \) into the three new fields. I tried the following but with no luck:

Data: \ValueA\ValueB\ValueC\ValueD...

RegEx: rex field=InputField "\\(?<Output1>.*)\\(?<Output2>.*)\\(?<Output3>.*)\\"

[richgalloway]

Regex101.com successfully parses your sample data with regex string you provided. What results are you getting and what are you expecting?

[macoo]

Well, it works in regex101.com but fail in Splunk with the following error:

Error in 'rex' command: Encountered the following error while compiling the regex '\(?.*)\(?.*)\(?.*)\': Regex: unmatched parentheses

[richgalloway]

That error message usually means an escape character is missing. The board messed up your regex string, however, so it's impossible to tell where the error might be. Please re-post your entire rex command by enclosing it within backtics.