Hi Community,
I'm struggling with a regex expression. I'm trying to extract fields (seperated by \
) into the three new fields. I tried the following but with no luck:
Data: \ValueA\ValueB\ValueC\ValueD...
RegEx: rex field=InputField "\\(?<Output1>.*)\\(?<Output2>.*)\\(?<Output3>.*)\\"
Regex101.com successfully parses your sample data with regex string you provided. What results are you getting and what are you expecting?
Well, it works in regex101.com but fail in Splunk with the following error:
Error in 'rex' command: Encountered the following error while compiling the regex '\(?.*)\(?.*)\(?.*)\': Regex: unmatched parentheses
That error message usually means an escape character is missing. The board messed up your regex string, however, so it's impossible to tell where the error might be. Please re-post your entire rex
command by enclosing it within backtics.