Splunk Search

Why is my rex command after upgrade to 6.3 not working

PPape
Contributor

Hello

I'm using this Regex command:

rex max_match=25 "\s+(?P<UserName>[^ ]+\s*\w*)\s+(?P<Status>[Allow|Deny]+)\s+(?P<Rigths>[\w+|-\d+][,\s+\w+]*)\n"

with Version 6.2.x it works fine but after upgrade to 6.3 I get this error:

Error in 'rex' command: Encountered the following error while compiling the regex '\s+(?P<UserName>[^ ]+\s*\w*)\s+(?P<Status>[Allow|Deny]+)\s+(?P<Rigths>[\w+|-\d+][,\s+\w+]*)\n': Regex: invalid range in character class

Here a pastebin of sample data -paste-

Am I the only one who is facing this?
I hope you can help me.

Best regards!

0 Karma
1 Solution

knielsen
Contributor

Hi,

pasting you rex expression into regex101 points out that [\w+|-\d+] is the problem. "-" is parsed as a range quantifier, which doesn't make sense in that expression. If that "-" should match an actual "-", then escape it with backslash.

Hth,
Kai.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I'm not sure of the exact cause, but I can guess. 6.3 might have introduced stronger regex validation. That being the case, the " " (blank space) might be the cause.

Try this:

rex max_match=25 "\s+(?P<UserName>[^\s]+\s*\w*)\s+(?P<Status>Allow|Deny)+\s+(?P<Rights>[\w+|-\d+][,\s+\w+]*)\n"
0 Karma

knielsen
Contributor

Hi,

pasting you rex expression into regex101 points out that [\w+|-\d+] is the problem. "-" is parsed as a range quantifier, which doesn't make sense in that expression. If that "-" should match an actual "-", then escape it with backslash.

Hth,
Kai.

PPape
Contributor

Sorry for late response, this was the right Answer!
Thank you very mutch Kai!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...