Is there a syntax error in my search to extract a field from the source field?

[HMTODD]

I am using the following search to extract a field, named 'JobName", from the field named "source"

index="nlg_test_csv_mfjobs" | rex field=source "SPLUNK\\(?[A-Z0-9]+)*_REPORT.*DETAILS.*\.CSV"

and I get this error:

Error in 'rex' command: Encountered the following error while compiling the regex 'SPLUNK\(?[A-Z0-9]+)*_REPORT.*DETAILS.*\.CSV': Regex: unmatched parentheses

I cannot find where the parenthesis are unmatched, unless they are being affected by the regular expression. The expression works in various online regex testers. I am concerned about some Splunk specific syntax that I may not be taking into account.

thanks.

[somesoni2]

Give this a try

index="nlg_test_csv_mfjobs" | rex field=source "SPLUNK\\\(?<JobName>[A-Z0-9]+)*_REPORT\.DETAILS\.CSV"

[richgalloway · Accepted solution]

The right parenthesis needs to be escaped.

SPLUNK\(?[A-Z0-9]+\)*_REPORT.DETAILS..CSV

Depending on the data you are trying to match, one or more of the dots may need to be escaped as well.

[HMTODD]

I am not a regx expert, but "guessed" that something was messing with the parenthesis (based on the error). Ultimately, this worked...

rex field=source "SPLUNK\(?[A-Z0-9]+)_REPORT.*DETAILS..CSV"

[HMTODD]

Note that the string is being modified by the page after I submit. The string here is NOT correct. Let's try this. Note that the real search string does not have the outer quotes.

" rex field=source "SPLUNK\(?[A-Z0-9]+)_REPORT.*DETAILS..CSV" "

[richgalloway]

So parens are not literally in your events. Didn't guess that without sample data. The new regex doesn't work in regex101.com, BTW, but that's probably a markup problem. If you put your regexes inside back-tics it won't be messed with by the site.