I keep getting the missing terminator error when trying to parse. I am not sure whats the problem
Here is my regex:
| rex field=referer "/en-US/app(?<<app>>[^/]+)/(?<<dashboard>&g>;[^?/\s]+)"
Hi Jewatson17,
could you share an example of the log to parse?
it seems that you want to parse the address of a dashboard,
if this is true probably the problem is a missed slash (/) and something elase, try something like this:
| rex field=referer "/en-US/app/(?<my_app>[^/]+)/(?<my_dashboard>[^?/ ]+)"
Bye.
Giuseppe
I'm trying to pull the usage of ALL the dashboards in my environment.
Hi @Jewatson17,
Try this:
| rex field=referer "\/en-US\/app\/(?<app>[^\/]+)\/(?<dashboard>[^?]+)"
Escaping the forward slashes is not even necessary I think. Key thing to fix is the redundant characters and the &g and ; in the dashboard field extraction.