Splunk Search

Regex command causing the search to not work - unknown search command

ssjabid
Explorer

Hi People,

I am trying to run a regex command to cut out a part of the REQ field,
On regex 101 it is working fine, however on Splunk it is causing problems and i get an unknown search command error

Here is the query i am using,

index=was_unauth sourcetype=ibm:was:jmx ReqMethod="POST" 
NOT [| inputlookup policy_wlist_ipaddr_digital_ | fields src]
| rename DIP as src, SIP as src CUST as username USR as username
| rex field=_raw REQ\=\".*\/(?<page>\w*[^0-9]+(\.jsp)?)\/?\"
| search src!="10.0.0.0/8" src!="141.92.0.0/16" NOT username=* page!="phoneauthentication" AND page!="1*"
| stats count by page

I do not want the regex command to cut out pages with numbers in them, so i've included [^0-9] in there which works on regex 101 but Splunk does not like it, even when i use a backslash to block it out but it still doesn't pull out the data,

I've also tried using

index=was_unauth sourcetype=ibm:was:jmx ReqMethod="POST" 
NOT [| inputlookup policy_wlist_ipaddr_digital_ | fields src]
| rename DIP as src, SIP as src CUST as username USR as username
| rex field=_raw REQ\=\".*\/(?<page>[a-zA-Z_]+(\.jsp)?)\/?\"
| search src!="10.0.0.0/8" src!="141.92.0.0/16" NOT username=* page!="phoneauthentication" AND page!="1*"
| stats count by page

but this gives me the unknown search command :a error

Any help would be greatly appreciated,
Thanks

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi ssjabid,
did you tried with quotes in rex command?

| rex "REQ\=\".*\/(?<page>\w*[^0-9]+(\.jsp)?)\/?\""

Optiion field=_raw isn't important.

Bye.
Giuseppe

View solution in original post

janispelss
Path Finder

The rex command requires quotation marks around the regex expression.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Required_arguments

gcusello
SplunkTrust
SplunkTrust

Hi ssjabid,
did you tried with quotes in rex command?

| rex "REQ\=\".*\/(?<page>\w*[^0-9]+(\.jsp)?)\/?\""

Optiion field=_raw isn't important.

Bye.
Giuseppe

ssjabid
Explorer

Managed to get it working 🙂 this did help! thank you!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ssjabid

Can you please share sample data???

0 Karma

ssjabid
Explorer

REQ="././././switches" EVC="EVT_TRACE" EID="securityfilter.request" DIP="" CLS="" 4ReqURI="///*/api/v1/switches"

so i am trying to capture the switches part in REQ however sometimes when a log appears with a number would appear instead, i would like to ignore that, but [^0-9] doesn't happen to work

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...