Splunk Search

Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

Path Finder

I keep getting the missing terminator error when trying to parse. I am not sure whats the problem

Here is my regex:

| rex field=referer "/en-US/app(?<<app>>[^/]+)/(?<<dashboard>&g>;[^?/\s]+)"
0 Karma

Legend

Hi Jewatson17,
could you share an example of the log to parse?
it seems that you want to parse the address of a dashboard,
if this is true probably the problem is a missed slash (/) and something elase, try something like this:

| rex field=referer "/en-US/app/(?<my_app>[^/]+)/(?<my_dashboard>[^?/ ]+)"

Bye.
Giuseppe

0 Karma

Path Finder

I'm trying to pull the usage of ALL the dashboards in my environment.

0 Karma

Super Champion

Hi @Jewatson17,
Try this:

| rex field=referer "\/en-US\/app\/(?<app>[^\/]+)\/(?<dashboard>[^?]+)"
0 Karma

Ultra Champion

Escaping the forward slashes is not even necessary I think. Key thing to fix is the redundant characters and the &g and ; in the dashboard field extraction.

0 Karma