Splunk Search

Why am I receiving an error in 'rex' command?

khairilfirza
Explorer

Hi team, I want to ask:
I cannot do extract new field and its show this error.

Error in 'rex' command: The regex 'Telco' does not extract anything. It should specify at least one named group. Format: (?...).

Before this my Telco was display on the selected field, but somehow it missing, and after that I cannot extract a new field.

Can you help me? Please

Tags (2)
1 Solution

jplumsdaine22
Influencer

I'm assuming your search looks like this:

 ... | rex "telco"

Like the error message says, you must put in a named capturing group so that Splunk knows what name to give your new field. For example, if you want to call that field "myField", your regex would look like this:

...| rex "(?<myField>telco)"

View solution in original post

premraj_vs
Path Finder

I had the same issue and after trying many complex solutions, the simple solution that worked for me is removing the space after field in rex command.

| rex field=_raw ".+\[(?P<ActionResponseandType>.+)]\s
0 Karma

khairilfirza
Explorer

alt text

0 Karma

j_cabanillas
Explorer

try * source="/var/log/va-router/vpn/vpn.log" | rex field=_raw "(?telco)"

khairilfirza
Explorer

it display this error:

Error in 'rex' command: Encountered the following error while compiling the regex '(?telco)': Regex: unrecognized character after (? or (?-

0 Karma

j_cabanillas
Explorer

could you add a log example where the Telco words is in ?

0 Karma

j_cabanillas
Explorer

So the in telco its provide information like Maxis , Digi, and Celcom. So when click on the telco it will display this field. But some how the telco is missing in this field from this search (* source="/var/log/va-router/vpn/vpn.log").

SO Maxis, Digi, Celcom are telecomunication service providers right? As jplumsdaine22 says , that data is not showing on your logs ,at least not in the one you showed us on the picture.

If that data is not part of the logs it means there must be a lookup for that data that someone created to associated part of the log to each provider.

For example:
The lookup could associate using VPN-SA01XXXX to Digi and VPN-CB01XXXXX to Celcom.
It could also be associated to external IPs, but I don't see external IPs in your logs

0 Karma

jplumsdaine22
Influencer

I'm assuming your search looks like this:

 ... | rex "telco"

Like the error message says, you must put in a named capturing group so that Splunk knows what name to give your new field. For example, if you want to call that field "myField", your regex would look like this:

...| rex "(?<myField>telco)"

khairilfirza
Explorer
![* source="/var/log/va-router/vpn/vpn.log" | rex "(?<Telco>telco)"][1]

I'm sorry, I dont know how to do this one, before this my telco is display on the selected field and interesting field.

Now I dont how to find the telco.

0 Karma

jplumsdaine22
Influencer

So the regex I have there will create a field called Telco with the value 'telco', if the event contains the string telco. This is unlikely to be what you want. Can you perhaps describe your search in more general terms?

khairilfirza
Explorer
  • source="/var/log/va-router/vpn/vpn.log"

This is the search i used for visualize data. In this search usually I got my telco in the field.
So the in telco its provide information like Maxis , Digi, and Celcom.
So when click on the telco it will display this field. But some how the telco is missing in this field from this search (* source="/var/log/va-router/vpn/vpn.log").

And because that "telco" field is missing I face the problem to extract the new field and show rex error.

Hope you understand

0 Karma

jplumsdaine22
Influencer

OK - I don't see any of those terms in your data, so I'm not sure if they are a field extraction or a lookup. It may be that someone made a lookup for the data and it has broken somehow. Have you contacted your Splunk admin?

493669
Super Champion

alt text

once you type your query select the query first and click 1010110 (above) button - like below
rex "(?.*)"

493669
Super Champion

can you provide your regex query using 101010 button so that no special character get escape

khairilfirza
Explorer

can i know where should i put 101010?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...