Splunk Search

Why am I getting "Error in 'rex' command...Regex: missing )"?

splunker1981
Path Finder

Hello All,

I am brand new to Splunk and can't for the life of me figure out what I am doing wrong. I would like to pull the following data from raw text (about 10 lines of so of raw text), extract to a new field and then replace data in that field from paren number paren with a period. So (number) with .

Sample data
(1)dkfj(10)dkeiieii(2)ljflkkldj(3)
(2)datadata(1)dta(10)dat(2)
(8)sample(3)sample(0)

I am using the following command in Splunk, but when I try to display the results, I get blank data:

tag=unencoded | rex "(?<formatEncode>(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))" | rex mode=sed field=formatEncode "s/([0-9])/./g"  | stats by formatEncode

I tested the regex and the sed substitution and both work just fine. I get the following error when I try to run it in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(?<formatEncode<(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))': Regex: missing )

Any help or pointer would be greatly appreciated.

Thanks in advance.

0 Karma
1 Solution

dkoops
Path Finder

Looks like you are missing a bracket at the end of your first rex command.

View solution in original post

somesoni2
Revered Legend

I'm assuming your sample data in question is showing data to be extracted from 3 different events.
You Sample data has variable number of strings (enclosed between numbers). Is that correct? Could you post full raw event as well?

0 Karma

dkoops
Path Finder

Looks like you are missing a bracket at the end of your first rex command.

splunker1981
Path Finder

Actually that was the issue, thanks.

For those trying to do something similar here is the command I used

rex "(?(\(\d+\))([A-Za-z0-9_\-]+\(\d+\))+\w+(\(\d+\)))" | rex mode=sed field=formatEncode "s/\([0-9]\)/./g" | stats by formatEncode
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...