Splunk Search
Highlighted

regex (Invalid regex: no named extraction at position 5 )

Explorer

I have problem with saving regex for extracting class name
Here is my regex

(?i)\[([0-9a-zA-Z\.\s\-]&ast;(\[[0-9]&ast;\])?[0-9a-zA-Z\.\s\-\/]&ast;)\]\s(?P<FIELDNAME>[^ ]+)

And here is log sample
12.02.2015 12:14:16.946 INFO [10.36.27.187 [1423743256597] GET /content/company/global/en/company/notices/polish.html HTTP/1.1] com.company.web.core.cdn.CDNTransformer CDN: http://static-dc.company.net
12.02.2015 14:17:03.340 INFO [pool-5-thread-3] org.apache.jackrabbit.core.state.SharedItemStateManager Validating change-set hierarchy

And here is splunk error
"Invalid regex: no named extraction at position 5 (i.e., "[([0-9a-zA..."). Expected "(?P<variable>pattern)""

Tags (1)
0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

Builder

You'll need to fix the formatting on your regex so it displays properly in the browser; we can't read it as is. Edit your question and substitute & # 92; (with no spaces) for all the backslashes.

0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

Explorer

done, thanks for notice

0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

SplunkTrust
SplunkTrust

The forward slash needs to be escaped.

You have nested capturing groups. Is that intentional?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

Explorer

in some log lines I have nested [] so I try to handle this in regex.

0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

SplunkTrust
SplunkTrust

This regex string works with your example log entries on regex101.com. It also handles nested brackets.

\[.*\]\s(?P<FIELDNAME>[^ ]+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: regex (Invalid regex: no named extraction at position 5 )

Explorer

Thanks 😄

0 Karma