Splunk Search

Regex error

Puzzle2011
Engager

I am trying to validate that the user has entered their phone number in this format (555) 555-5555. I keep getting this error: Unmatched ) in regex; marked by <-- HERE in m/[([0-9]) <-- HERE ]+[[0-9]-]+[[0-9]+/ at validate.cgi line 46. My code is below. Any help?

sub validate_input {
my $valid = "Y";
my $errormsg;
if ($phone !~ m/[([0-9])]+[[0-9]-]+[[0-9]+/]) {
$valid = "N";
my $errormsg = "enter a valid phone number in format desired.";
}
return $valid, $errormsg;
}

Tags (2)
0 Karma
1 Solution

tpflicke
Path Finder

The characters ( and ) in regex are used for grouping so you need to escape them if you want to match literally.
You can also use \d for digit, I find it more readable than [0-9].
Try

m/\(\d\d\d\)\s*\d\d\d-\d\d\d\d/ 
m/\(\d{3}\)\s*\d{3}-\d{4}/
m/\(\d+\)\s*\d+-\d+/

depending on whether you want to exactly match the number of digits and preference of style.

View solution in original post

tpflicke
Path Finder

The characters ( and ) in regex are used for grouping so you need to escape them if you want to match literally.
You can also use \d for digit, I find it more readable than [0-9].
Try

m/\(\d\d\d\)\s*\d\d\d-\d\d\d\d/ 
m/\(\d{3}\)\s*\d{3}-\d{4}/
m/\(\d+\)\s*\d+-\d+/

depending on whether you want to exactly match the number of digits and preference of style.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...