Splunk Search

How do I write the regular expression to extract fields separated by a backslash?

macoo
Explorer

Hi Community,

I'm struggling with a regex expression. I'm trying to extract fields (seperated by \) into the three new fields. I tried the following but with no luck:

Data: \ValueA\ValueB\ValueC\ValueD...

RegEx: rex field=InputField "\\(?<Output1>.*)\\(?<Output2>.*)\\(?<Output3>.*)\\"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Regex101.com successfully parses your sample data with regex string you provided. What results are you getting and what are you expecting?

---
If this reply helps you, Karma would be appreciated.
0 Karma

macoo
Explorer

Well, it works in regex101.com but fail in Splunk with the following error:

Error in 'rex' command: Encountered the following error while compiling the regex '\(?.*)\(?.*)\(?.*)\': Regex: unmatched parentheses

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That error message usually means an escape character is missing. The board messed up your regex string, however, so it's impossible to tell where the error might be. Please re-post your entire rex command by enclosing it within backtics.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...