I have a search that works as I would like it to
source="Radius" "accounting:accountinginfo=added" OR login-user | rex field=_raw "User: (?
However when I transform it to my dashboard search string
source="Radius" "accounting:accountinginfo=added" OR login-user | rex field=_raw "User: (?<User>.*)"
I get
"Error in 'rex' command: Encountered the following error while compiling the regex 'User:(?
I'm sure this is something simple but I'm new to splunk and regex and am having problems finding the problem.
The first part of the query is working fine....its pulling info from different sources. The problem is, and it didn't show well in my post is that the dashboard xml is eating my < and > signs, so I tried to replace them with ampersand lt and gt, but then I get the missing terminator.