Splunk Search

Regex issue

approachct
Path Finder

Having trouble with the below regex generated from the field extractor application
\w+:\\w+\\w+\(?P\w+\\w+)

When added to the search as below
index=utility sourcetype="componentcheck"|rex field=FILENAME \w+:\\w+\\w+\(?P\w+\\w+)

and example input of
d:\A\B\C\D\E\F.dll (there are back slashes between each letter)

I get an two of the same errors -
Error in 'rex' command: Encountered the following error while compiling the regex '\w+:\w+\w+(?P\w+\w+)': Regex: unmatched parentheses

What am I doing wrong?

Tags (1)

kushagra9120
Explorer

Try this:-

"[a-zA-Z]:(?:(?:\\[a-zA-Z]){5}\\)(?P[a-zA-Z].\w+)"

0 Karma

landen99
Motivator

Sample regex has many issues:

\w+:\\\w+\\\w+\(?P\w+\\\w+)

While the sample regex fails to escape the backslash correctly or name the capture group, here is what I think that you are trying to match:

| stats count | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "(\w+[\:\\\]+){3}(?<my_field>\w+\\\+\w+)" | table FILENAME, my_field
0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

The first parenthesis is escaped: (
The regex engine thinks that there is an unmatched closing parenthesis at the end of your expression.

0 Karma

tpflicke
Path Finder

The confusing/awkward bit is the escaping of backslash in regular expressions, see here, in short to match a literal \ you need \\\\

Below are a couple of solutions of how to extract the basename - anything surrounding the rex clause if just test framework.

| metadata type=sourcetypes | head 1 | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "[a-z]:.*\\\\(?<area>\w+\.\w+)" | table FILENAME, area

| metadata type=sourcetypes | head 1 | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll"  | rex field=FILENAME "[a-zA-Z]\:\\\\(\w+\\\\)*(?<area>\w+\.\w+)" | table FILENAME, area

Lamar
Splunk Employee
Splunk Employee

I would write this a bit differently, more importantly you seem to be missing a backslash before your word-ish chunk after your field name (?P<area>\w+\w+)

Additionally, you might get it to evaluate a bit better if you write it this way:

[a-zA-Z]{1}\:\\\w+\\\w+\\(?P<area>\w+\\\w+)

I'm not sure if that's what you're trying to extract, but you get the general idea. And maybe I'm just a creature of habit but I like to put double quotes around my regex:

index=utility sourcetype="componentcheck"|rex field=FILENAME "[a-zA-Z]{1}\:\\\w+\\\w+\\(?P<area>\w+\\\w+)"

approachct
Path Finder

No the indexer is Linux

0 Karma

Lamar
Splunk Employee
Splunk Employee

The "indexer/search head" is on Windows...yes?

0 Karma

approachct
Path Finder

Thanks, I copied your regex exactly, quotes and all, but I am still getting the below error with the suggested regex.
Error in 'rex' command: Encountered the following error while compiling the regex '[a-zA-Z]{1}:\w+\w+(?P\w+\w+)': Regex: unmatched parentheses

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...