Below is the my query:
index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc-* OR msgId=sdv-* OR msgId=wer-* OR msgId=qwe-*
| rex field=msgId "(?.)-"
And it throws error like below:
Error in 'rex' command: Encountered the following error while compiling the regex '(?.)-': Regex: unrecognized character after (? or (?-
How do I fix that issue?
Hi maryang,
I think you should supply in the name of the field to which you want to assign the reg-extracted values. The new field values should be included in brackets (). For example, if you want to assign reg-extracted values to a field named msgprefix, use the following search:
index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc- OR msgId=sdv- OR msgId=wer- OR msgId=qwe-
| rex field=msgId "(?<msgprefix>.)-"
Hope it helps. Thanks!
Hunter
Hi maryang,
execute the following search in splunk:
| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>.*)-"
Your regex is not quite right. Your capturing group must be a so called "naming group" Next .
just referes to any character except line break but just once. you want any character until a -
. By following your approch you will add *
(zero or more times) to the .
.
A maybe little bit better approach might be to capture everything from the beginning of the line which is not a -
:
| makeresults | eval msgId="abc-" | rex field=msgId "(?<name_your_field>^[^-]+)-"
Sincerely,
hgrow
Hi maryang,
I think you should supply in the name of the field to which you want to assign the reg-extracted values. The new field values should be included in brackets (). For example, if you want to assign reg-extracted values to a field named msgprefix, use the following search:
index=app splunk_server_group=CWE sourcetype=ELMTP99 host="CHE-elmAPP0" source="C:\TPles\ELMgFile.log" sourcetype="elm99"
msgId=abc- OR msgId=sdv- OR msgId=wer- OR msgId=qwe-
| rex field=msgId "(?<msgprefix>.)-"
Hope it helps. Thanks!
Hunter