Below is the my query:
index=app splunkservergroup=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc-* OR msgId=sdv-* OR msgId=wer-* OR msgId=qwe-*
| rex field=msgId "(?.)-"
And it throws error like below:
Error in 'rex' command: Encountered the following error while compiling the regex '(?.)-': Regex: unrecognized character after (? or (?-
I think you should supply in the name of the field to which you want to assign the reg-extracted values. The new field values should be included in brackets (). For example, if you want to assign reg-extracted values to a field named msgprefix, use the following search:
index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc- OR msgId=sdv- OR msgId=wer- OR msgId=qwe-
| rex field=msgId "(?<msgprefix>.)-"
| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-"
Your regex is not quite right. Your capturing group must be a so called "naming group" Next . just referes to any character except line break but just once. you want any character until a -. By following your approch you will add * (zero or more times) to the ..
A maybe little bit better approach might be to capture everything from the beginning of the line which is not a -:
| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-"