Regex works with in regex101 but not in Splunk

[lbrhyne]

The following expression works in regex101: https://regex101.com/r/4D68Ip/1
But not in Splunk. Any help would be appreciated

(?i)nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)

We are attempting to extract 58570 from the below string.

TEST STING

run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk"}

[lbrhyne]

I thought I would pop in and let you all know the resolution from Splunk.

:\d{2}\s+(?P<Successful>\d+)\s+(?P<Failed>\d+)\s+(?P<Percentage>\S+) IN bodyPreview

[inventsekar]

Hi @lbrhyne 

You can do one simple idea - just search for a 5 digit numbers in your logs(Pls check the logs and see if there are any other 5 digit numbers)

| makeresults | eval log="run.\r\nTimeframe (PT)  Success Failed  % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk\"}" 
| rex field=log (?P<Successful>\d{5}) | table log Successful

[gcusello · Accepted solution]

Hi @lbrhyne,

there's an issue in field extraction in Splunk when you have in your logs one or more backslashes, in my opinion it's a bug and I discussed with Support specialists about this.

In this case use (trying) three or four backslashes instead of two as in regex101.

You must use this workaround if you use the rex command in a search.

If instead you want to use the regex for a field extraction not in a search, you have to use the regex that works in regex101.

ciao.

Giuseppe

[lbrhyne]

@gcusello Thank You! Your solution worked, partly. At search time this worked perfectly: 

Using - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\\\w+\\\\\w+\\\\\w+\\\\\w\d+\:\d+\-\d+\:\d+\\\\\w+\\\\\w+\\\\\w+\\\\\w(?P<Successful>\d+)

However, neither the regex above or the following worked as a field extract: 

Regex101 - nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)

I have opened up a ticket with Splunk to see  if they can figure it out. For now I will be using the search time extraction. If Splunk provides a solution, I will post an update.

[gcusello]

Hi @lbrhyne,

I also opened a case to Splunk Support and thay said that this behavior is all normal!

Please push also you so maybe they will understand!

I'm discussing with them because for me this is a bug, also because, if you create a field extraction, using the regex101 regex (it's the only one that runs in field extractions!) and then you try to use the IFX, you'll have a red error!

Ciao.

Giuseppe