Splunk Search

rex operation -- Regex: syntax error in subpattern name (missing terminator)

apalmier
New Member

Hi,

I'm continuously receiving the error Regex: syntax error in subpattern name (missing terminator) when attempting to search with a 'rex' operation.  I've gone through several different message boards and nothing seems to resolve the issue.  Any help would be greatly appreciated!

My intention is to grab the "Http-Method" value from the raw event.

Search:

[Search...] | rex field=_raw "Method: (?<Http-Method>.*)"

Sample Event:

2021-10-28 10:55:39,505 1109468116 [http-bio-8443-exec-9] INFO o.a.c.i.LoggingInInterceptor - Inbound Message ----------------------------
ID: 41087
Address: [...Sensitive Information Removed...]

Encoding: ISO-8859-1
Http-Method: POST
Content-Type: application-xml

Headers: [...Sensitive Information Removed...]

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen (-) character is not allowed in field names.  Try this

| rex field=_raw "Method: (?<HttpMethod>\w*)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://www.pcre.org/current/doc/html/pcre2pattern.html#SEC16

In PCRE2, a capture group can be named in one of three ways: (?<name>...) or (?'name'...) as in Perl, or (?P<name>...) as in Python. Names may be up to 32 code units long. When PCRE2_UTF is not set, they may contain only ASCII alphanumeric characters and underscores, but must start with a non-digit. When PCRE2_UTF is set, the syntax of group names is extended to allow any Unicode letter or Unicode decimal digit. In other words, group names must match one of these patterns:

  ^[_A-Za-z][_A-Za-z0-9]*\z   when PCRE2_UTF is not set
  ^[_\p{L}][_\p{L}\p{Nd}]*\z  when PCRE2_UTF is set

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...