Hi,
I want to extract a certain part of a string, for instance:
Input
\\domain.org\teams\team1\bla\bla\bla
\\domain.org\teams\team2\bla\bla
\\domain.org\teams\team3\bla
\\domain.org\teams\team4
I want the following output:
team1
team2
team3
team4
I'm using the below Regex which works in Regex101 but not on Splunk.
The regex I'm using is:
(^\\\\domain\.org\\teams\\)(?P<Team>[^\\]+)
and has this error in Splunk:
Error in 'rex' command: Encountered the following error while compiling the regex '(^\\domain\.org\\teams\)(?P<Team>[^\]+)': Regex: missing terminating ] for character class
You're right, check the correct one
| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"
You're right, check the correct one
| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"
Amazing, thank you.
Please try this one
(^\\\\domain\.org\\teams\\)(?<Team>[^\\]+)
Hi,
Thanks - it still throws the same error though
Regex: missing terminating ] for character class