Splunk Search

Regex is correct but splunk throws error

Explorer

For the following log, I would like to filter by a string. I would have to extract the string using regex.

traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_SEND_MACBOOKS\",\"commands\.....}
traceId=xyz msg=Patch for deviceId with body {"parameters":[{"value":"{\"code\":\"ABC_DEF_OPEN_MACBOOKS\",\"commands\.....}

My Splunk query is as follows.
host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" | rex "code\\"\:\\"(?<codes>.{20})" | where codes=ABC_DEF_SEND_MACBOOKS

But splunk throws the below error related to regex
Error in 'rex' command: Encountered the following error while compiling the regex 'code\\:\(?<codes>.{20})': Regex: unmatched closing parenthesis

When I checked the regex in regex101.com, the output for codes is as expected.
What is wrong with the parenthesis in this case?

0 Karma
1 Solution

Champion

try this:

    host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" |  rex field=_raw "code\\\+\":+\\\+\"(?<codes>.*?)\\\+" | where codes="ABC_DEF_SEND_MACBOOKS"

in your where condition you also need to have your string within quotes like above

View solution in original post

Champion

try this:

    host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" |  rex field=_raw "code\\\+\":+\\\+\"(?<codes>.*?)\\\+" | where codes="ABC_DEF_SEND_MACBOOKS"

in your where condition you also need to have your string within quotes like above

View solution in original post

Super Champion

my guess is reason of failure is due to you not escaping double quotes "

Try something like..

host=* sourcetype="*" source="example.log" "msg=Patch for deviceId*" | rex "code\\\"\:\\\"(?<codes>.{20})" 

cheers

0 Karma