Splunk Search

Mismatch '[' error in field extraction using regular expression

Manonmani5
New Member

I am a new splunk user and apologies for this dump question. I tried to extract a field with the fort "servername:portnumber"

( ex: sd45j478889:23684) using field extractor.

I got the below regular expression in field extractor.

^(?:[^"\n]*"){8}\s+(?P[^ ]+)

This didn't worked for all the events because of different sourcetypes. So I tried to use this regex in my search. When I used this in my search I am getting "Mismatch '[' " error. Below is the query I used.

index= xyz | rex "^(?:[^"\n]*"){8}\s+(?P[^ ]+)"|table Port

I couldn't find what is wrong with the expression. can someone please help

0 Karma
1 Solution

kthammireddygar
Path Finder
  1. Can you please provide the whole event.

View solution in original post

0 Karma

niketn
Legend

@Manonmani5 while posting sample event or code, please use the code button (101010 or CTRL+K) on Splunk Answers to ensure that special characters in your code or sample data does not get escaped. Alternatively you can add four spaces before each line of your code and make sure there is an enter before the first line of code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kthammireddygar
Path Finder
  1. Can you please provide the whole event.
0 Karma

Manonmani5
New Member

[19/Apr/2018:07:44:36 -0400] "GET /tyywuenndri/css/select2.png HTTP/1.1" 200 613 "https://eps.nyuehrnf.com/ajeunx/css/select2.css" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" "3373" "ij10k222:25898"

0 Karma

kthammireddygar
Path Finder

Try this :

index=abc sourcetype=xyz | rex "\"(?P<Servername>\w+)\:(?P<Portnumber>\d+)\""

0 Karma

Manonmani5
New Member

Thanks.. This worked for me

0 Karma

Manonmani5
New Member

May I know what was the problem with the below regex.

^(?:[^"\n]*"){8}\s+(?P[^ ]+)

This expression I got when I extracted the field using 'Field Extractor'

0 Karma

p_gurav
Champion

Can you try :

| rex field= _raw "(?P<servername>[^\:]+):(?P<portnumber>+)"
0 Karma

p_gurav
Champion

Also one question servername:portnumber is always same the way you specified in example. Is it field or you are extracting from raw event. Can you provide whole event?

0 Karma

Manonmani5
New Member

Yes.. The format is same... But the server name and port number will be different based on servers. While executing the above regex I am getting error as "The regex '_raw' does not extract anything. It should specify at least one named group. Format: (?...). "

0 Karma

p_gurav
Champion

I already made a group called servername and portnumber above? My mistake, remove space:

| rex field=_raw "(?P<servername>[^\:]+):(?P<portnumber>+)"
0 Karma

Manonmani5
New Member

This is the error I am getting."Error in 'rex' command: Encountered the following error while compiling the regex '(?P[^:]+):(?P+)': Regex: nothing to repeat"
Sample Event:
[19/Apr/2018:07:44:36 -0400] "GET /tyywuenndri/css/select2.png HTTP/1.1" 200 613 "https://eps.nyuehrnf.com/ajeunx/css/select2.css" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" "3373" "ij10k222:25898"

0 Karma

Manonmani5
New Member

Thanks. It didn't worked. For the second one 'I got error as 'Error in 'rex' command: Encountered the following error while compiling the regex '(?P[^:]+):(?P+)': Regex: nothing to repeat'.

And for the first I got error like 'Error in 'SearchParser': Missing a search command before '^'. Error at position '64' of search query 'search index= spider_prod | rex "^(?:[^\"\n]*"){8...{snipped} {errorcontext = (?P[^ ]+)"}'.'

Below is the search condition I used for the first one.

index= xyz | rex "^(?:[^\"\n]*"){8}\s+(?P[^ ]+)"

0 Karma

Sukisen1981
Champion

can you give a sample of your raw event?

0 Karma

Manonmani5
New Member

30.130.51.1 eps.vincetryu.com - [19/Apr/2018:07:44:36 -0400] "GET /tyywuenndri/css/select2.png HTTP/1.1" 200 613 "https://eps.nyuehrnf.com/ajeunx/css/select2.css" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" "3373" "ij10k222:25898"

0 Karma

Manonmani5
New Member

Above is the sample event . I have to extract "ij10k222.25898" from the event

0 Karma

p_gurav
Champion

Can you try:

| rex "^(?:[^\"\n]*"){8}\s+(?P[^ ]+)"

Also try :

| rex "(?P<servername>[^\:]+):(?P<portnumber>+)"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...