Splunk Search

Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

Jewatson17
Path Finder

I keep getting the missing terminator error when trying to parse. I am not sure whats the problem

Here is my regex:

| rex field=referer "/en-US/app(?<<app>>[^/]+)/(?<<dashboard>&g>;[^?/\s]+)"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Jewatson17,
could you share an example of the log to parse?
it seems that you want to parse the address of a dashboard,
if this is true probably the problem is a missed slash (/) and something elase, try something like this:

| rex field=referer "/en-US/app/(?<my_app>[^/]+)/(?<my_dashboard>[^?/ ]+)"

Bye.
Giuseppe

0 Karma

Jewatson17
Path Finder

I'm trying to pull the usage of ALL the dashboards in my environment.

0 Karma

493669
Super Champion

Hi @Jewatson17,
Try this:

| rex field=referer "\/en-US\/app\/(?<app>[^\/]+)\/(?<dashboard>[^?]+)"
0 Karma

FrankVl
Ultra Champion

Escaping the forward slashes is not even necessary I think. Key thing to fix is the redundant characters and the &g and ; in the dashboard field extraction.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...