This is my query.
index=snaptor sourcetype=AccessApp | fillnull value=NULL | eval query_string = upper(query_string) | fields uri, productid, query_string | rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?[.:\-\w]+(,[.:\-\w]+)*|[\w])" | eval syms=upper(syms) | eval syms = urldecode(syms) | rex field=syms mode=sed "s/\+/,/g" | makemv delim="," syms | mvexpand syms | stats count(uri) by productid, uri
It works fine until I try to write the results to a summary index and that's when I see this error:
Error in 'rex' command: Regex match error, please check log
The only thing I can find in the log is this:
05-26-2016 03:04:23.204 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'rex' command: Regex match error, please check log
but then again I'm not great at interpreting the log. Is there something wrong with my regex? Like I said it works outside the summary index.
I think @somesoni2 is on to something. It is quite possible that there are 2 different RegEx parsers and one (non-SI) doesn't care if you capture things without naming them but then the other one (SI) does care. In any case, try adding names like he indicates.
Hmm... . Maybe the web doesn't like the < in there but this should have been in the original post.
| rex field=query_string "(SYMBOL=|SYMBOLS=|P1=|P2=)+(?<syms>[.:\-\w]+(,[.:\-\w]+)*|[\w])"