Splunk Search

rex operation -- Regex: syntax error in subpattern name (missing terminator)

apalmier
New Member

Hi,

I'm continuously receiving the error Regex: syntax error in subpattern name (missing terminator) when attempting to search with a 'rex' operation.  I've gone through several different message boards and nothing seems to resolve the issue.  Any help would be greatly appreciated!

My intention is to grab the "Http-Method" value from the raw event.

Search:

[Search...] | rex field=_raw "Method: (?<Http-Method>.*)"

Sample Event:

2021-10-28 10:55:39,505 1109468116 [http-bio-8443-exec-9] INFO o.a.c.i.LoggingInInterceptor - Inbound Message ----------------------------
ID: 41087
Address: [...Sensitive Information Removed...]

Encoding: ISO-8859-1
Http-Method: POST
Content-Type: application-xml

Headers: [...Sensitive Information Removed...]

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen (-) character is not allowed in field names.  Try this

| rex field=_raw "Method: (?<HttpMethod>\w*)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://www.pcre.org/current/doc/html/pcre2pattern.html#SEC16

In PCRE2, a capture group can be named in one of three ways: (?<name>...) or (?'name'...) as in Perl, or (?P<name>...) as in Python. Names may be up to 32 code units long. When PCRE2_UTF is not set, they may contain only ASCII alphanumeric characters and underscores, but must start with a non-digit. When PCRE2_UTF is set, the syntax of group names is extended to allow any Unicode letter or Unicode decimal digit. In other words, group names must match one of these patterns:

  ^[_A-Za-z][_A-Za-z0-9]*\z   when PCRE2_UTF is not set
  ^[_\p{L}][_\p{L}\p{Nd}]*\z  when PCRE2_UTF is set

 

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...