Splunk Search

Regex Error - Regex: PCRE does not support \L, \l, \N{name}, \U, or \u

Builder

A little help needed. Regex below is throwing the error in title of question...

rex field=source "N:\\logs\\(?P<UID>[^_]+)"

The source I am trying to match against has following format...

N:\logs\username_blah.log

Thanks!

Tags (3)
0 Karma
1 Solution

Revered Legend

You need one more backward slash for escape. This works fine with sample value.

|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"

View solution in original post

0 Karma

Revered Legend

You need one more backward slash for escape. This works fine with sample value.

|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"

View solution in original post

0 Karma

Builder

Doesn't seem to work with either 2 or 4 backslashes as transform.

0 Karma

SplunkTrust
SplunkTrust

transforms.conf should require only two backslashes.

The rex command takes a string - that string uses backslashes as its escape character, requiring extra backslashes. transforms.conf doesn't take a string in a programming sense, so there's one fewer layer of escaping going on.

0 Karma

Revered Legend

Try with 4 backslashes.

0 Karma

Builder

That worked inline, thanks!

Any idea how to get this to work in a transform? I get same error when I save transform three slashes and it doesn't work with two.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!