Splunk Search

What is wrong with my regex? "Regex: missing terminating ] for character class"

dbcase
Motivator

Hi,

I have this data
{"analyticType":"CustomAnalytic","buildTarget":"blah","clientSessionId":"DXFMLAF-CYTQQQK","Properties":{"index":1,"args":["{\"accountId\":\"exr244040\",\"customerId\":\"1001857\"}"],"category":"Event"}}

And this regex (which works in regex101

accountId\\":\\"(?<extref>[^\\]+)

but splunk barfs when I use it in this query

index=wholesale_app CustomAnalytic Properties.index=1|rex "accountId\\":\\"(?<extref>[^\\]+)"|stats count by extref

with this error message

Error in 'rex' command: Encountered the following error while compiling the regex 'accountId\:\(?<extref>[^\]+)': Regex: missing terminating ] for character class

(scratches head).....what am I doing wrong?

Tags (2)
0 Karma
1 Solution

DalJeanis
Legend

Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.

Here's run-anywhere code...

| makeresults 
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."

| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"

updated from

| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"

In this case, I used this construct [\\\\] to represent a single escape character \ , and the construct [\\\"] to represent a single quote ".

View solution in original post

dbcase
Motivator

Figured it out, splunk requires more escaping of slash characters

0 Karma

DalJeanis
Legend

Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.

Here's run-anywhere code...

| makeresults 
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."

| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"

updated from

| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"

In this case, I used this construct [\\\\] to represent a single escape character \ , and the construct [\\\"] to represent a single quote ".

becksyboy
Contributor

Thanks this worked for me

0 Karma

dbcase
Motivator

thanks DalJeanis!

I ended up with

rex "accountId.....(?<extref>[^\\\]+)"

DalJeanis
Legend

Good job. Updated to the simpler version.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...