Splunk Search
Highlighted

What is causing the Rex Raw c-ip syntax error?

Contributor

Hi,

I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)

My rex expression is this:

index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

Blue log snippet is :

[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

What am I doing wrong? Is it the '-' between the <>? If so how do i escape?

Thanks

0 Karma
Highlighted

Re: What is causing the Rex Raw c-ip syntax error?

Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.

0 Karma
Highlighted

Re: What is causing the Rex Raw c-ip syntax error?

Contributor

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

View solution in original post

0 Karma
Highlighted

Re: What is causing the Rex Raw c-ip syntax error?

Contributor

thank you!

0 Karma
Highlighted

Re: What is causing the Rex Raw c-ip syntax error?

Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:

index = bcoat 
| head 1 
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"
0 Karma