Rex Error help: How to extract a certain part of a string?

[bomran]

Hi,

I want to extract a certain part of a string, for instance:

Input

\\domain.org\teams\team1\bla\bla\bla
\\domain.org\teams\team2\bla\bla
\\domain.org\teams\team3\bla
\\domain.org\teams\team4

I want the following output:

team1
team2
team3
team4

I'm using the below Regex which works in Regex101 but not on Splunk.

The regex I'm using is:

(^\\\\domain\.org\\teams\\)(?P<Team>[^\\]+)

and has this error in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(^\\domain\.org\\teams\)(?P<Team>[^\]+)': Regex: missing terminating ] for character class

[tiagofbmm · Accepted solution]

You're right, check the correct one

| rex field=_raw "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)"

[bomran]

Amazing, thank you.

[tiagofbmm]

Please try this one

(^\\\\domain\.org\\teams\\)(?<Team>[^\\]+)

[bomran]

Hi,

Thanks - it still throws the same error though
Regex: missing terminating ] for character class