Splunk Search

What is wrong with my regex? "Regex: missing terminating ] for character class"

dbcase
Motivator

Hi,

I have this data
{"analyticType":"CustomAnalytic","buildTarget":"blah","clientSessionId":"DXFMLAF-CYTQQQK","Properties":{"index":1,"args":["{\"accountId\":\"exr244040\",\"customerId\":\"1001857\"}"],"category":"Event"}}

And this regex (which works in regex101

accountId\\":\\"(?<extref>[^\\]+)

but splunk barfs when I use it in this query

index=wholesale_app CustomAnalytic Properties.index=1|rex "accountId\\":\\"(?<extref>[^\\]+)"|stats count by extref

with this error message

Error in 'rex' command: Encountered the following error while compiling the regex 'accountId\:\(?<extref>[^\]+)': Regex: missing terminating ] for character class

(scratches head).....what am I doing wrong?

Tags (2)
0 Karma
1 Solution

DalJeanis
Legend

Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.

Here's run-anywhere code...

| makeresults 
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."

| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"

updated from

| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"

In this case, I used this construct [\\\\] to represent a single escape character \ , and the construct [\\\"] to represent a single quote ".

View solution in original post

dbcase
Motivator

Figured it out, splunk requires more escaping of slash characters

0 Karma

DalJeanis
Legend

Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.

Here's run-anywhere code...

| makeresults 
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."

| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"

updated from

| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"

In this case, I used this construct [\\\\] to represent a single escape character \ , and the construct [\\\"] to represent a single quote ".

becksyboy
Contributor

Thanks this worked for me

0 Karma

dbcase
Motivator

thanks DalJeanis!

I ended up with

rex "accountId.....(?<extref>[^\\\]+)"

DalJeanis
Legend

Good job. Updated to the simpler version.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...