Splunk Search

rex operation -- Regex: syntax error in subpattern name (missing terminator)

apalmier
New Member

Hi,

I'm continuously receiving the error Regex: syntax error in subpattern name (missing terminator) when attempting to search with a 'rex' operation.  I've gone through several different message boards and nothing seems to resolve the issue.  Any help would be greatly appreciated!

My intention is to grab the "Http-Method" value from the raw event.

Search:

[Search...] | rex field=_raw "Method: (?<Http-Method>.*)"

Sample Event:

2021-10-28 10:55:39,505 1109468116 [http-bio-8443-exec-9] INFO o.a.c.i.LoggingInInterceptor - Inbound Message ----------------------------
ID: 41087
Address: [...Sensitive Information Removed...]

Encoding: ISO-8859-1
Http-Method: POST
Content-Type: application-xml

Headers: [...Sensitive Information Removed...]

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The hyphen (-) character is not allowed in field names.  Try this

| rex field=_raw "Method: (?<HttpMethod>\w*)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://www.pcre.org/current/doc/html/pcre2pattern.html#SEC16

In PCRE2, a capture group can be named in one of three ways: (?<name>...) or (?'name'...) as in Perl, or (?P<name>...) as in Python. Names may be up to 32 code units long. When PCRE2_UTF is not set, they may contain only ASCII alphanumeric characters and underscores, but must start with a non-digit. When PCRE2_UTF is set, the syntax of group names is extended to allow any Unicode letter or Unicode decimal digit. In other words, group names must match one of these patterns:

  ^[_A-Za-z][_A-Za-z0-9]*\z   when PCRE2_UTF is not set
  ^[_\p{L}][_\p{L}\p{Nd}]*\z  when PCRE2_UTF is set

 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...