Splunk Search

regex error only when saving to summary index

billycote
Path Finder

This is my query.

index=snaptor sourcetype=AccessApp
| fillnull value=NULL
| eval query_string = upper(query_string)
| fields uri, productid, query_string  
| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?[.:\-\w]+(,[.:\-\w]+)*|[\w])" 
| eval syms=upper(syms) 
| eval syms = urldecode(syms) 
| rex field=syms mode=sed "s/\+/,/g"
| makemv delim="," syms 
| mvexpand syms
| stats count(uri) by productid, uri

It works fine until I try to write the results to a summary index and that's when I see this error:

Error in 'rex' command: Regex match error, please check log 

The only thing I can find in the log is this:

05-26-2016 03:04:23.204 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'rex' command: Regex match error, please check log

but then again I'm not great at interpreting the log. Is there something wrong with my regex? Like I said it works outside the summary index.

0 Karma

woodcock
Esteemed Legend

I think @somesoni2 is on to something. It is quite possible that there are 2 different RegEx parsers and one (non-SI) doesn't care if you capture things without naming them but then the other one (SI) does care. In any case, try adding names like he indicates.

0 Karma

billycote
Path Finder

Hmm... . Maybe the web doesn't like the < in there but this should have been in the original post.

| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?<syms>[.:\-\w]+(,[.:\-\w]+)*|[\w])" 
0 Karma

somesoni2
Revered Legend

I don't see any fields extracted using name capturing groups in your regex ( like (?<fieldname>someregex+) ). Did you miss while copying the query OR editor truncated it?

0 Karma

billycote
Path Finder
| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?<syms>[.:\-\w]+(,[.:\-\w]+)*|[\w])" 
0 Karma

woodcock
Esteemed Legend

How exactly are you "trying to write the results to a summary index"?

0 Karma

billycote
Path Finder

scheduled search with summary index enabled.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...