Regex issue

[approachct]

Having trouble with the below regex generated from the field extractor application
\w+:\\w+\\w+\(?P

When added to the search as below
index=utility sourcetype="componentcheck"|rex field=FILENAME \w+:\\w+\\w+\(?P

and example input of
d:\A\B\C\D\E\F.dll (there are back slashes between each letter)

I get an two of the same errors -
Error in 'rex' command: Encountered the following error while compiling the regex '\w+:\w+\w+(?P

What am I doing wrong?

[kushagra9120]

Try this:-

"[a-zA-Z]:(?:(?:\\[a-zA-Z]){5}\\)(?P[a-zA-Z].\w+)"

[landen99]

Sample regex has many issues:

\w+:\\\w+\\\w+\(?P\w+\\\w+)

While the sample regex fails to escape the backslash correctly or name the capture group, here is what I think that you are trying to match:

| stats count | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "(\w+[\:\\\]+){3}(?<my_field>\w+\\\+\w+)" | table FILENAME, my_field

[cstump_splunk]

The first parenthesis is escaped: (
The regex engine thinks that there is an unmatched closing parenthesis at the end of your expression.

[tpflicke]

The confusing/awkward bit is the escaping of backslash in regular expressions, see here, in short to match a literal \ you need \\\\

Below are a couple of solutions of how to extract the basename - anything surrounding the rex clause if just test framework.

| metadata type=sourcetypes | head 1 | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "[a-z]:.*\\\\(?<area>\w+\.\w+)" | table FILENAME, area

| metadata type=sourcetypes | head 1 | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "[a-zA-Z]\:\\\\(\w+\\\\)*(?<area>\w+\.\w+)" | table FILENAME, area

[Lamar]

I would write this a bit differently, more importantly you seem to be missing a backslash before your word-ish chunk after your field name (?P<area>\w+\w+)

Additionally, you might get it to evaluate a bit better if you write it this way:

[a-zA-Z]{1}\:\\\w+\\\w+\\(?P<area>\w+\\\w+)

I'm not sure if that's what you're trying to extract, but you get the general idea. And maybe I'm just a creature of habit but I like to put double quotes around my regex:

index=utility sourcetype="componentcheck"|rex field=FILENAME "[a-zA-Z]{1}\:\\\w+\\\w+\\(?P<area>\w+\\\w+)"

[approachct]

No the indexer is Linux

[Lamar]

The "indexer/search head" is on Windows...yes?

[approachct]

Thanks, I copied your regex exactly, quotes and all, but I am still getting the below error with the suggested regex.
Error in 'rex' command: Encountered the following error while compiling the regex '[a-zA-Z]{1}:\w+\w+(?P