Splunk Search
Highlighted

Problem with the simplest rex

Path Finder

I have several error logs that have a similar format:

Cannot set Single Use Prices on Single Room Standard Room (
Cannot set Single Use Prices on Single Room Standard Suite (
Cannot set Single Use Prices on Single Room Executive King Room (

The rex that I am attempting to use only returns a table of blank lines.

"Cannot set Single Use Prices on Single Room " |rex "(?<Error>\w+?)\(" | table Error

I've tried \w \w+ \w+? \. \.+ \.+?

Any suggestions?

Tags (3)
0 Karma
Highlighted

Re: Problem with the simplest rex

Super Champion

Is there a space between the last word and the "(". If so, your regex isn't going to match. Try:

| rex "(?\w+)\s+("

Highlighted

Re: Problem with the simplest rex

Splunk Employee
Splunk Employee

Also, \w will not match spaces, so all you're going to get is the word "Room" or "Suite".

0 Karma
Highlighted

Re: Problem with the simplest rex

Super Champion

That's true. It depends on what you are looking for. rachelneal, if you would provided additional details in your question (use the "edit" link below you question), then a more suitable regex could be suggested. Specifically, note what strings you would like to extract from the samples given.

0 Karma
Highlighted

Re: Problem with the simplest rex

Contributor

try

| rex "(?<Error>[^\r\n\(]+)\("
0 Karma
Highlighted

Re: Problem with the simplest rex

Path Finder

Thanks everyone. I ended up with rex "\"(?.+?(\d+?)).+?\'(?\d+?)\'.+?\'(?\d+?)\'" after getting rex "\"(?.+?(" to work. Woohoo!

View solution in original post

0 Karma