RegEx Square Brackets not supported?

[svercelli]

Using rex and it seems as if Splunk sees the open square bracket as the beginning of a subsearch. Have I written this wrong or is there a workaround

| rex \w+\.\w+\.\w+[a-z]\_(?<Facility>[[:alnum:]]+)

[alemarzu · Accepted solution]

Hi there,

Missing quotes perhaps, | rex "\w+\.\w+\.\w+[a-z]\_(?<Facility>[[:alnum:]]+)"

[svercelli]

Yep, worked, I feel a bit silly.

[alemarzu]

Glad it worked. It happens all the time!!