About eid1550

eid1550 · ‎06-22-2021

Hi. I have an event that has the line "Total time taken for process: 535 ms" in it. it's not in a field it's just a raw event. I want to extract just the 535 ms from it, and so I came up with this. index = *"1500"* "Total time taken for process:" | regex _raw "\d+ ms" its the correct regular expression any number of digits followed by space followed by ms but its not working in splunk, and I am not sure why. it keeps throwing error Usage: regex <field> (=!=) <regex> I am not sure what this means.

eid1550 · ‎01-14-2020

I figured it out after A LOT of trial and error. the following is the "python version" I kept printing what python say and kept modyifying it so it looks like the string in splunk IDE | rex field=_raw "(?ms)^(?:[^\\"\\n]\\"){6}(?P\\d+)(?:[^\\"\\n]\\"){4}(?P[^\\\\]+)" thank you for your help and guiding me in the right direction

eid1550 · ‎01-14-2020

@jawaharas yeah it says the same thing "Error in search parser mis matched ']' its a nightmare.

eid1550 · ‎01-13-2020

@gaurav_maniar Hi Gaurav! Yea that is part of it, but the issue also resides in the first half of the query for example the first half here "raw "(?ms)^(?:[^\"\n]*\"){6}(?P\d+)" also gives me the same error... what am i suppose to escape here?

eid1550 · ‎01-13-2020

@jawaharas Hi the python is just in a variable like this query = """| rex field=_raw "(?ms)^(?:[^\"\n]\"){6}(?P\d+)(?:[^\"\n]\"){4}(?P[^\\]+)""" then executed later.

eid1550 · ‎01-12-2020

I am using the python splunk SDK to run a query, and this part of the query is giving me the above mismatched brackets error. | rex field=_raw "(?ms)^(?:[^\"\\n]*\"){6}(?P<Error_code>\\d+)(?:[^\"\\n]*\"){4}(?P<Error_description>[^\\\\]+)" It works when I put it in the actual splunk search, but when I run it through python its giving me that error. What could be the problem?

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-12-2020

Online Status	Offline
Date Last Visited	‎06-22-2021 07:19 PM

Simple regex extraction not working?

Error in "SearchParser" mismatched ']'

Simple regex extraction not working?

Re: Error in "SearchParser" mismatched ']'

Re: Error in "SearchParser" mismatched ']'

Re: Error in "SearchParser" mismatched ']'

Re: Error in "SearchParser" mismatched ']'

Error in "SearchParser" mismatched ']'