What is causing the Rex Raw c-ip syntax error?

[brdr]

Hi,

I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)

My rex expression is this:

index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

Blue log snippet is :

[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

What am I doing wrong? Is it the '-' between the <>? If so how do i escape?

Thanks

[elliotproebstel]

Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:

index = bcoat 
| head 1 
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"

[brdr · Accepted solution]

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

[brdr]

thank you!

[elliotproebstel]

Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.