Splunk Search

regex (Invalid regex: no named extraction at position 5 )

broman
Explorer

I have problem with saving regex for extracting class name
Here is my regex

(?i)\[([0-9a-zA-Z\.\s\-]&ast;(\[[0-9]&ast;\])?[0-9a-zA-Z\.\s\-\/]&ast;)\]\s(?P<FIELDNAME>[^ ]+)

And here is log sample
12.02.2015 12:14:16.946 INFO [10.36.27.187 [1423743256597] GET /content/company/global/en/company/notices/polish.html HTTP/1.1] com.company.web.core.cdn.CDNTransformer CDN: http://static-dc.company.net
12.02.2015 14:17:03.340 INFO [pool-5-thread-3] org.apache.jackrabbit.core.state.SharedItemStateManager Validating change-set hierarchy

And here is splunk error
"Invalid regex: no named extraction at position 5 (i.e., "[([0-9a-zA..."). Expected "(?P<variable>pattern)""

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex string works with your example log entries on regex101.com. It also handles nested brackets.

\[.*\]\s(?P<FIELDNAME>[^ ]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex string works with your example log entries on regex101.com. It also handles nested brackets.

\[.*\]\s(?P<FIELDNAME>[^ ]+)
---
If this reply helps you, Karma would be appreciated.
0 Karma

broman
Explorer

Thanks 😄

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The forward slash needs to be escaped.

You have nested capturing groups. Is that intentional?

---
If this reply helps you, Karma would be appreciated.
0 Karma

broman
Explorer

in some log lines I have nested [] so I try to handle this in regex.

0 Karma

cphair
Builder

You'll need to fix the formatting on your regex so it displays properly in the browser; we can't read it as is. Edit your question and substitute & # 92; (with no spaces) for all the backslashes.

0 Karma

broman
Explorer

done, thanks for notice

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...