Splunk Search

Rex Error help: How to extract a certain part of a string?

bomran
Explorer

Hi,

I want to extract a certain part of a string, for instance:

Input

\\domain.org\teams\team1\bla\bla\bla
\\domain.org\teams\team2\bla\bla
\\domain.org\teams\team3\bla
\\domain.org\teams\team4

I want the following output:

team1
team2
team3
team4

I'm using the below Regex which works in Regex101 but not on Splunk.

The regex I'm using is:

(^\\\\domain\.org\\teams\\)(?P<Team>[^\\]+)

and has this error in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(^\\domain\.org\\teams\)(?P<Team>[^\]+)': Regex: missing terminating ] for character class

0 Karma
1 Solution

tiagofbmm
Influencer

You're right, check the correct one

| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"

View solution in original post

tiagofbmm
Influencer

You're right, check the correct one

| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"

bomran
Explorer

Amazing, thank you.

0 Karma

tiagofbmm
Influencer

Please try this one

(^\\\\domain\.org\\teams\\)(?<Team>[^\\]+)
0 Karma

bomran
Explorer

Hi,

Thanks - it still throws the same error though
Regex: missing terminating ] for character class

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...