How to split a string into 2 separate fields in Splunk 6.5.0?

[HeinzWaescher]

Hi,

before Splunk 6.5.0 I used commands like this to split strings into separate fields.

For fields like productId=abc_text_def

 | rex field=productId "(?<field1>.*)\_text_(?<field2>.*)"

Since 6.5.0 this does not work anymore. The error is:

Error in 'rex' command: Encountered the following error while compiling the regex '(?<field1>.*)\_text_(?<field2>.*): Regex: unrecognized character follows \

Can you help me to fix this?

[cmerriman · Accepted solution]

| rex field=productId "(?<field1>.*)_text_(?<field2>.*)"

try it without the \ does it work?

[HeinzWaescher]

that was fast & easy, thanks a lot 🙂