I am brand new to Splunk and can't for the life of me figure out what I am doing wrong. I would like to pull the following data from raw text (about 10 lines of so of raw text), extract to a new field and then replace data in that field from paren number paren with a period. So (number) with .
I am using the following command in Splunk, but when I try to display the results, I get blank data:
tag=unencoded | rex "(?<formatEncode>(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))" | rex mode=sed field=formatEncode "s/([0-9])/./g" | stats by formatEncode
I tested the regex and the sed substitution and both work just fine. I get the following error when I try to run it in Splunk:
Error in 'rex' command: Encountered the following error while compiling the regex '(?<formatEncode<(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))': Regex: missing )
I'm assuming your sample data in question is showing data to be extracted from 3 different events.
You Sample data has variable number of strings (enclosed between numbers). Is that correct? Could you post full raw event as well?