Splunk Search

Rex Error help: How to extract a certain part of a string?

bomran
Explorer

Hi,

I want to extract a certain part of a string, for instance:

Input

\\domain.org\teams\team1\bla\bla\bla
\\domain.org\teams\team2\bla\bla
\\domain.org\teams\team3\bla
\\domain.org\teams\team4

I want the following output:

team1
team2
team3
team4

I'm using the below Regex which works in Regex101 but not on Splunk.

The regex I'm using is:

(^\\\\domain\.org\\teams\\)(?P<Team>[^\\]+)

and has this error in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(^\\domain\.org\\teams\)(?P<Team>[^\]+)': Regex: missing terminating ] for character class

0 Karma
1 Solution

tiagofbmm
Influencer

You're right, check the correct one

| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"

View solution in original post

tiagofbmm
Influencer

You're right, check the correct one

| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"

bomran
Explorer

Amazing, thank you.

0 Karma

tiagofbmm
Influencer

Please try this one

(^\\\\domain\.org\\teams\\)(?<Team>[^\\]+)
0 Karma

bomran
Explorer

Hi,

Thanks - it still throws the same error though
Regex: missing terminating ] for character class

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...