Splunk Search

Regex: syntax error in subpattern name (missing terminator)

edrivera3
Builder

Hi
I encountered the following error message :

Error Message:
Error in 'rex' command: Encountered the following error while compiling the regex '(?<failed_step>STEP:[&#92w&#92W\n]+?RETRIES:\s{3}\d+)': Regex: syntax error in subpattern name (missing terminator)

The extraction works correctly in the Search and Reporting App.

This my html page:
<script>
var deps = [
"splunkjs/ready!",
"splunkjs/mvc",
"splunkjs/mvc/utils",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/chartview",
"splunkjs/mvc/checkboxgroupview",
"splunkjs/mvc/checkboxview",
"splunkjs/mvc/dropdownview",
"splunkjs/mvc/eventsviewerview",
"splunkjs/mvc/multidropdownview",
"splunkjs/mvc/radiogroupview",
"splunkjs/mvc/searchbarview",
"splunkjs/mvc/searchcontrolsview",
"splunkjs/mvc/singleview",
"splunkjs/mvc/tableview",
"splunkjs/mvc/textinputview",
"splunkjs/mvc/timelineview",
"splunkjs/mvc/timerangeview",
"splunkjs/mvc/simplexml",
"splunkjs/mvc/splunkmapview",
"jquery",
"splunk_wftoolkit/components/bubblechart/bubblechart",
"splunk.config",
"underscore"
];
require(deps, function(mvc) {
// Load individual components
var SearchManager = require("splunkjs/mvc/searchmanager");
var TimelineView = require("splunkjs/mvc/timelineview");
var ChartView = require("splunkjs/mvc/chartview");
var CheckboxGroupView = require("splunkjs/mvc/checkboxgroupview");
var CheckboxView = require("splunkjs/mvc/checkboxview");
var DropdownView = require("splunkjs/mvc/dropdownview");
var EventsViewer = require("splunkjs/mvc/eventsviewerview");
var MultiDropdownView = require("splunkjs/mvc/multidropdownview");
var RadioGroupView = require("splunkjs/mvc/radiogroupview");
var SearchbarView = require("splunkjs/mvc/searchbarview");
var SearchControlsView = require("splunkjs/mvc/searchcontrolsview");
var SingleView = require("splunkjs/mvc/singleview");
var TableView = require("splunkjs/mvc/tableview");
var TextInputView = require("splunkjs/mvc/textinputview");
var TimeRangeView = require("splunkjs/mvc/timerangeview");
var BubbleView = require("splunk_wftoolkit/components/bubblechart/bubblechart");

// Table (Top Failed Steps in test containing this error)

var Top_FailStep = new SearchManager({
    id: "Top_FailStep",
    search: mvc.tokenSafe('index=tirfile AND [search index=jobevent earliest=\"-1y\" latest=\"now\" error_num=$error_num$ test_num=$test_num$ | fields test_num,cart_num] | rex field=test_step \"(?&lt;failed_step&gt;STEP:[\\w\\W\\n]+?RETRIES:\\s{3}\\d+)\" '),
        cache: true,
        preview: true
});

var table_Top_FailStep = new TableView({
    id: "table_Top_FailStep",
    managerid: "Top_FailStep",
    el: $("#table_Top_FailStep")
}).render();

I appreciate your help.

0 Karma
1 Solution

edrivera3
Builder

First of all, thanks stephanefotso for trying to help.

I found the solution to my problem. Appears that when you are working with web framework you cannot use the HTML entity to add a < > symbols. The way around this is to simply escape < > symbols.

    search: mvc.tokenSafe('index=tirfile AND [search index=jobevent  earliest="-1y" latest="now" error_num=$error_num$ test_num=$test_num$ | fields test_num,cart_num] | rex field=test_step "(?\<failed_step\>STEP:[\\w\\W\\n]+RETRIES:\\s{3}\\d+)" max_match=0 '),

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...