Splunk Search

Why am I getting "Error in 'rex' command...Regex: missing )"?

splunker1981
Path Finder

Hello All,

I am brand new to Splunk and can't for the life of me figure out what I am doing wrong. I would like to pull the following data from raw text (about 10 lines of so of raw text), extract to a new field and then replace data in that field from paren number paren with a period. So (number) with .

Sample data
(1)dkfj(10)dkeiieii(2)ljflkkldj(3)
(2)datadata(1)dta(10)dat(2)
(8)sample(3)sample(0)

I am using the following command in Splunk, but when I try to display the results, I get blank data:

tag=unencoded | rex "(?<formatEncode>(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))" | rex mode=sed field=formatEncode "s/([0-9])/./g"  | stats by formatEncode

I tested the regex and the sed substitution and both work just fine. I get the following error when I try to run it in Splunk:

Error in 'rex' command: Encountered the following error while compiling the regex '(?<formatEncode<(\(\d+\))(\w+\(\d+\))+\w+(\(\d+\))': Regex: missing )

Any help or pointer would be greatly appreciated.

Thanks in advance.

0 Karma
1 Solution

dkoops
Path Finder

Looks like you are missing a bracket at the end of your first rex command.

View solution in original post

somesoni2
Revered Legend

I'm assuming your sample data in question is showing data to be extracted from 3 different events.
You Sample data has variable number of strings (enclosed between numbers). Is that correct? Could you post full raw event as well?

0 Karma

dkoops
Path Finder

Looks like you are missing a bracket at the end of your first rex command.

View solution in original post

splunker1981
Path Finder

Actually that was the issue, thanks.

For those trying to do something similar here is the command I used

rex "(?(\(\d+\))([A-Za-z0-9_\-]+\(\d+\))+\w+(\(\d+\)))" | rex mode=sed field=formatEncode "s/\([0-9]\)/./g" | stats by formatEncode
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!