Hi,
I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)
My rex expression is this:
index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"
Blue log snippet is :
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED
What am I doing wrong? Is it the '-' between the <>? If so how do i escape?
Thanks
The command is:
index = bcoat | head 1 | rex field=_raw "(?<
c-ip>
\d+.\d+.\d+.\d+)"
blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED
Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:
index = bcoat
| head 1
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"
The command is:
index = bcoat | head 1 | rex field=_raw "(?<
c-ip>
\d+.\d+.\d+.\d+)"
blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED
thank you!
Can you edit your post and wrap code and regex snippets with the code 101010
button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.