Splunk Search

Regex Error - Regex: PCRE does not support \L, \l, \N{name}, \U, or \u

snoobzilla
Builder

A little help needed. Regex below is throwing the error in title of question...

rex field=source "N:\\logs\\(?P<UID>[^_]+)"

The source I am trying to match against has following format...

N:\logs\username_blah.log

Thanks!

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You need one more backward slash for escape. This works fine with sample value.

|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You need one more backward slash for escape. This works fine with sample value.

|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"
0 Karma

snoobzilla
Builder

Doesn't seem to work with either 2 or 4 backslashes as transform.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

transforms.conf should require only two backslashes.

The rex command takes a string - that string uses backslashes as its escape character, requiring extra backslashes. transforms.conf doesn't take a string in a programming sense, so there's one fewer layer of escaping going on.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try with 4 backslashes.

0 Karma

snoobzilla
Builder

That worked inline, thanks!

Any idea how to get this to work in a transform? I get same error when I save transform three slashes and it doesn't work with two.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...