Informix Audit Regular Expression

[klkumar10]

I have the following content in the log file

====

ONLN|2010-07-06 13:53:52.000|test.tester.com|1068|db_server_name|informixuser|0:RDRW:dbname:477:139460610:483356

ONLN|2010-07-06 14:39:58.000|testpc.tester.com|8368|db_server_name|mware|0:OPDB:dbname:0:-

ONLN|2010-07-06 13:54:00.000|testpc2.test.com|9122|db_server_name|informix|0:ACTB:sysmaster:informix:sysadtinfo:166
.
.

====

When I use the following Regular Expression in the search string it works and gives the exact result I am looking for:

====

rex ".*?(\|).*?(\|).*?(\|).*?(\|).*?(\|)(?P<FIELDNAME>\w+)(\|)" | fields FIELDNAME

====

But When I try to use Extract Fields and there If I try to give this as my Regular Expression, it is giving me error:

====

Invalid regex: no named extraction at position 3 (i.e., "(\|).*?(\|..."). Expected "(?P<variable>;pattern)"

====

Can someone please help me in identifying the error?

My Aim is to make the 6th Field (| delimited) as a new field userid

[Michael_Wilde · Accepted solution]

First of all.. You need your field to be named in a capturing group. When you're using "rex", Splunk needs to know what you'd like your field name called. I'm not sure why you're capturing all those "pipe" characters in parens... I'd have written the regex like this. Its cleaner and more exact.

(syntax is "anything thats not a pipe--many times", followed by a pipe.. (repeated until you get to your sixth field).

|rex "[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|[^\|]+\|(?<FIELDNAME>[^\|]+)"

[klkumar10]

I used the above expression directly in the props.conf file and able to use it. I did not use the IFX.

[klkumar10]

Actually I am new to using Regular Expressions.
Your RE solved my problem.

Thanks a lot.

[ftk]

Modify your regex as follows in the IFX (Interactive Field eXtraction) and it should work:

.?(\|).?(\|).?(\|).?(\|).*?(\|)(?P<FIELDNAME>\w+)(\|)

[klkumar10]

I tried above in the IFX, and it is giving me error:

Invalid regex: no named extraction at position 2 (i.e., "(|).?(|)..."). Expected "(?P<variable>pattern)"

Anyway thanks for the response. Now my issue is resolved as per the previous answer.