Splunk Search
Highlighted

rex field can not work

New Member

Below is the my query:
index=app splunkservergroup=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc-* OR msgId=sdv-* OR msgId=wer-* OR msgId=qwe-*
| rex field=msgId "(?.)-"
And it throws error like below:
Error in 'rex' command: Encountered the following error while compiling the regex '(?.
)-': Regex: unrecognized character after (? or (?-

How do I fix that issue?

Tags (1)
0 Karma
Highlighted

Re: rex field can not work

Splunk Employee
Splunk Employee

Hi maryang,

I think you should supply in the name of the field to which you want to assign the reg-extracted values. The new field values should be included in brackets (). For example, if you want to assign reg-extracted values to a field named msgprefix, use the following search:

index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99" 
msgId=abc- OR msgId=sdv- OR msgId=wer- OR msgId=qwe-
| rex field=msgId "(?<msgprefix>.)-"

Hope it helps. Thanks!
Hunter

View solution in original post

0 Karma
Highlighted

Re: rex field can not work

Communicator

Hi maryang,

execute the following search in splunk:

| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-"

Your regex is not quite right. Your capturing group must be a so called "naming group" Next . just referes to any character except line break but just once. you want any character until a -. By following your approch you will add * (zero or more times) to the ..

A maybe little bit better approach might be to capture everything from the beginning of the line which is not a -:

 | makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-"

Sincerely,
hgrow

0 Karma