Splunk Search

Regex Error

rahiparikh
Explorer

Hi,

I am trying to use simple regex to find clients with specific IPs. My regex looks like

status=404 | regex host=*10.\d\d\d.\d\d\d.\d\d\d*

When I run the search in splunk it gives me error which looks like -

Error in 'SearchOperator:regex': The regex '*10.\d\d\d.\d\d\d.\d\d\d*' is invalid. nothing to repeat.

I am completely new to splunk. So, any help is appreciated.

Thanks,

Rahil

Tags (3)
1 Solution

carmackd
Communicator

Your problem might be that you didnt escape the dots(.) in your regular expression. Try this:

 | regex host="10\.\d+\.\d+\.\d+"

View solution in original post

0 Karma

phatfingers
Explorer

The prior poster gave good advice about an additional problem. The particular error shown, "nothing to repeat", was referring to the use of an asterisk as the first character. The asterisk means "zero or more of the preceding token" (e.g. the most recent discrete thing just to the left of the asterisk). Because the given regex started with an asterisk, Splunk threw an error because there was nothing to the left of the asterisk to repeat.

sideview
SplunkTrust
SplunkTrust

Depending on what you're trying to do you might be better off just searching for the IP addresses than using regex command. status="404" host="10.*"

0 Karma

carmackd
Communicator

Your problem might be that you didnt escape the dots(.) in your regular expression. Try this:

 | regex host="10\.\d+\.\d+\.\d+"
0 Karma

carmackd
Communicator

No problem! Glad to help 🙂

0 Karma

rahiparikh
Explorer

Thanks for the help. I just copied the text from Splunk User Manual but didn't know that I need to escape the dots.

Thanks again for you help. 🙂

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...