Splunk Search

Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Task1906
Explorer

Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below:
I am trying to extract everything before \ or \

Error in 'rex' command: Encountered the following error while compiling the regex '(?[^].)': Regex: missing terminating ] for character class*

| rex field=src_user "\\(?<user>[^\\].*)" 

Here are the examples of what I'm trying to extract:
DTTSOL-EAST\SQLAdmin
DTTSOL-EAST\SQLAdmin
task@delly\mason
DANNY@rand\D
calicoe\iron

What am I doing wrong and should I use something else besides regxex101?

Tags (2)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

View solution in original post

Task1906
Explorer

thank you!!! It works like a charm.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Task1906

Can you please try this?

Your_search  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Sample Search:

| makeresults | eval src_user="DTTSOL-EAST\\SQLAdmin"  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Thanks

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!