Splunk Search

What is causing the Rex Raw c-ip syntax error?

brdr
Contributor

Hi,

I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)

My rex expression is this:

index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

Blue log snippet is :

[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

What am I doing wrong? Is it the '-' between the <>? If so how do i escape?

Thanks

0 Karma
1 Solution

brdr
Contributor

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

View solution in original post

0 Karma

elliotproebstel
Champion

Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:

index = bcoat 
| head 1 
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"
0 Karma

brdr
Contributor

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

0 Karma

brdr
Contributor

thank you!

0 Karma

elliotproebstel
Champion

Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...