Splunk Search
Highlighted

Why am I getting regex error "unrecognized character" with my current rex syntax?

Explorer

Hello Everyone,

I have a problem with Splunk 6.3 when I am trying to run the rex statement:

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P<conname>([A-Z0-9#$$%.]{0,42}))\"" max_match=1                  

The next message is shown:

Error in 'rex' command: Encountered the following error while compiling the regex 'WTIDCCN[-_]\d\d\d\d":"(?P<conname>([A-Z0-9#$$%.]{0,42}))"': Regex: unrecognized character after (?P

What is wrong with my regex?

Any posible solutions?

REgards

0 Karma
Highlighted

Re: Why am I getting regex error "unrecognized character" with my current rex syntax?

Legend

You have quotation marks within quotation marks. You escaped them but I wonder what would happen if you used the hex code for the internal quotation marks instead: \x22

Highlighted

Re: Why am I getting regex error "unrecognized character" with my current rex syntax?

Motivator

Can you share a data sample of the event ?

0 Karma
Highlighted

Re: Why am I getting regex error "unrecognized character" with my current rex syntax?

Explorer

Thanks everybody for your participation, i was able to solve mi problem.

I was using in the search app

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P<conname>([A-Z0-9#$$%.]{0,42}))\"" max_match=1

Here is the solution:

| rex "WTIDCCN[-_]\d\d\d\d\":\"(?P([A-Z0-9#$$%.]{0,42}))\"" max_match=1 

View solution in original post

0 Karma