Splunk Search

MAP with REGEX not working

berserkersyco
New Member

hi,

i wanted to fetch some information from my logs. here is the scenario:

index=xyz host=xxx.com source="/as/df/gh/*.log" "[error]"
| rex field=_raw "LoadPlanName:\s(?P<LP_Name>[^\]]*)"
| table LP_Name
| dedup LP_Name

above query gives me the result as below

LP_Name
LP_abc
LP_abc1
LP_abc2

now from the same source i want to fetch other details for the LP_Name extracted above i.e LP_abc, LP_abc1, LP_abc2, for that i tried to create below query which is not working:

index=xyz host=xxx.com source="/dir1/dir2/*.log" "[error]"
| rex field=_raw "LoadPlanName:\s(?P<LP_Name>[^\]]*)"
| table LP_Name
| dedup LP_Name
| map search = "search index=xyz host=xxx.com source="/dir1/dir2/*.log" "[completed]"
| rex field=_raw "LoadPlanName:\s(?P<LPN>[^\]]*)"
LPN=$LP_Name"

For above query i have been getting below error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '417' of search query 'search index=oitp host=ITCNCHN-LX4* source="/opt/o...{snipped} {errorcontext = s(?P<LPN>[^\]]*)" L}'.

i have been struggling with it from a long time now, need help to get the the data that i desired. Thanks in advance.

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think Splunk is complaining about the embedded quotation marks in the map command.  Try escaping them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...