Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below:
I am trying to extract everything before \ or \
Error in 'rex' command: Encountered the following error while compiling the regex '(?[^].)': Regex: missing terminating ] for character class*
| rex field=src_user "\\(?<user>[^\\].*)"
Here are the examples of what I'm trying to extract:
What am I doing wrong and should I use something else besides regxex101?
Assuming the number of backslashes can vary, I would just go for the following:
| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"
View solution in original post
thank you!!! It works like a charm.
Can you please try this?
Your_search | rex field=src_user "\\\\(?<user>[^\\\\].*)"
| makeresults | eval src_user="DTTSOL-EAST\\SQLAdmin" | rex field=src_user "\\\\(?<user>[^\\\\].*)"