Splunk Search

Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Task1906
Explorer

Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below:
I am trying to extract everything before \ or \

Error in 'rex' command: Encountered the following error while compiling the regex '(?[^].)': Regex: missing terminating ] for character class*

| rex field=src_user "\\(?<user>[^\\].*)" 

Here are the examples of what I'm trying to extract:
DTTSOL-EAST\SQLAdmin
DTTSOL-EAST\SQLAdmin
task@delly\mason
DANNY@rand\D
calicoe\iron

What am I doing wrong and should I use something else besides regxex101?

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

View solution in original post

javiergn
Super Champion

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

Task1906
Explorer

thank you!!! It works like a charm.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Task1906

Can you please try this?

Your_search  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Sample Search:

| makeresults | eval src_user="DTTSOL-EAST\\SQLAdmin"  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...