Splunk Search

Why is my regex causing Splunk to return the following error?: "Regex: missing terminating ] for character class"

Task1906
Explorer

Rexex101 works GREAT. However, Splunk gives me an error. I keep getting the following error with the regex below:
I am trying to extract everything before \ or \

Error in 'rex' command: Encountered the following error while compiling the regex '(?[^].)': Regex: missing terminating ] for character class*

| rex field=src_user "\\(?<user>[^\\].*)" 

Here are the examples of what I'm trying to extract:
DTTSOL-EAST\SQLAdmin
DTTSOL-EAST\SQLAdmin
task@delly\mason
DANNY@rand\D
calicoe\iron

What am I doing wrong and should I use something else besides regxex101?

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

View solution in original post

javiergn
Super Champion

Assuming the number of backslashes can vary, I would just go for the following:

| rex field=src_user "[\\\]+(?<user>[^\\\]+)$"

Thanks,
J

Task1906
Explorer

thank you!!! It works like a charm.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Task1906

Can you please try this?

Your_search  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Sample Search:

| makeresults | eval src_user="DTTSOL-EAST\\SQLAdmin"  | rex field=src_user "\\\\(?<user>[^\\\\].*)"

Thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...