Splunk Search

Why am I getting regex error "unrecognized character" with my current rex syntax?

cesar_tomas
Explorer

Hello Everyone,

I have a problem with Splunk 6.3 when I am trying to run the rex statement:

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P<conname>([A-Z0-9#$$%.]{0,42}))\"" max_match=1                  

The next message is shown:

Error in 'rex' command: Encountered the following error while compiling the regex 'WTIDCCN[-_]\d\d\d\d":"(?P<conname>([A-Z0-9#$$%.]{0,42}))"': Regex: unrecognized character after (?P

What is wrong with my regex?

Any posible solutions?

REgards

0 Karma
1 Solution

cesar_tomas
Explorer

Thanks everybody for your participation, i was able to solve mi problem.

I was using in the search app

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P<conname>([A-Z0-9#$$%.]{0,42}))\"" max_match=1

Here is the solution:

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P([A-Z0-9#$$%.]{0,42}))\"" max_match=1 

View solution in original post

0 Karma

cesar_tomas
Explorer

Thanks everybody for your participation, i was able to solve mi problem.

I was using in the search app

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P<conname>([A-Z0-9#$$%.]{0,42}))\"" max_match=1

Here is the solution:

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P([A-Z0-9#$$%.]{0,42}))\"" max_match=1 
0 Karma

alemarzu
Motivator

Can you share a data sample of the event ?

0 Karma

lguinn2
Legend

You have quotation marks within quotation marks. You escaped them but I wonder what would happen if you used the hex code for the internal quotation marks instead: \x22

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>