Splunk Search

Field extraction receiving error message

atatistcheff
Explorer

Any time I try using the Extract Field option in an event list the next page returns this error:

Error in 'rex' command:

The regex '//' does not extract anything. It should specify at least one named group. Format: (?...).

This used to work but it's been a few months since I tried it. I'm not doing anything special as you can see. The regex is just // yet it returns nothing. I tried restarting Splunk but I think something is broken somewhere.

0 Karma
1 Solution

atatistcheff
Explorer

I found the problem, there was a field extraction saved with just // in the regex. Not sure how it got there or why it was screwing up the extract. Deleting this extraction fixed the issue, I can now proceed through the wizard to extract additional fields.

alt text

View solution in original post

atatistcheff
Explorer

I found the problem, there was a field extraction saved with just // in the regex. Not sure how it got there or why it was screwing up the extract. Deleting this extraction fixed the issue, I can now proceed through the wizard to extract additional fields.

alt text

woodcock
Esteemed Legend

Great job! Now come back here and click Accept on your answer to close the question.

0 Karma

atatistcheff
Explorer

Thanks for the answer but I have no way to mention a field name. To be clear, all i'm doing is clicking the Extract Fields option in the event and getting an error. Please see the screenshots below.

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

The screenshots are not attached.

0 Karma

atatistcheff
Explorer

Sorry, I'm not good at attaching. See if you can find them here.

alt text
alt text

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

In which Splunk Version you are getting this error?

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

According to me, you have to mention field name in rex, which you can use further,
like (?<Name>//)

Please refer doc for more info:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...