- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
erex not working in splunk 6
In previous versions of splunk, I've been able to use erex at search time to define a regular expression based on search time data, which is especially helpful in very large events or very spread out events. It used to display the regular expression needed to extract the field properly below the search bar. Now I get an error every time I try to use it that says:
The external search command 'erex' did not return events in descending time order, as expected. and it no longer tries to build the rex statement. Is this a regression? erex was an extremely valuable search command and I'd love to get it back!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I am also in a "Searching and Reporting " session (Self paced) and i also get this error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In reading the question, it looked like there were two parts:
- Where is the regular expression
- The error message about
The external search command 'erex' did not return events in descending time order, as expected.
I think the first part has been answered, but not the second, so ...
If you see that error message, try sorting the data before the erex command (e.g. | sort -_time
)
I'm actually in the Searching and Reporting training session and we saw the error message. When it wasn't working, I googled and found this page, but no solution. I then asked the instructor who didn't know. Since I found this work around, I just wanted to share in hopes of helping some one.
Just FYI I saw it on 6.1.3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The regex is still available, it's just not presented as a banner. You can view it under the Job menu.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Yay! I will update the docs as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sophy, you are awesome. Thank you. That worked for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am wondering the same. I have not received an error, but the erex does not attempt to build a rex statement.
