rex field can not work

[maryang]

Below is the my query:
index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc-* OR msgId=sdv-* OR msgId=wer-* OR msgId=qwe-*
| rex field=msgId "(?.)-"
And it throws error like below:
Error in 'rex' command: Encountered the following error while compiling the regex '(?.)-': Regex: unrecognized character after (? or (?-

How do I fix that issue?

[hgrow]

Hi maryang,

execute the following search in splunk:

| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-"

Your regex is not quite right. Your capturing group must be a so called "naming group" Next . just referes to any character except line break but just once. you want any character until a -. By following your approch you will add * (zero or more times) to the ..

A maybe little bit better approach might be to capture everything from the beginning of the line which is not a -:

 | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-"

Sincerely,
hgrow

[hunters_splunk · Accepted solution]

Hi maryang,

I think you should supply in the name of the field to which you want to assign the reg-extracted values. The new field values should be included in brackets (). For example, if you want to assign reg-extracted values to a field named msgprefix, use the following search:

index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99" 
msgId=abc- OR msgId=sdv- OR msgId=wer- OR msgId=qwe-
| rex field=msgId "(?<msgprefix>.)-"

Hope it helps. Thanks!
Hunter