Hi,
I have this data
{"analyticType":"CustomAnalytic","buildTarget":"blah","clientSessionId":"DXFMLAF-CYTQQQK","Properties":{"index":1,"args":["{\"accountId\":\"exr244040\",\"customerId\":\"1001857\"}"],"category":"Event"}}
And this regex (which works in regex101
accountId\\":\\"(?<extref>[^\\]+)
but splunk barfs when I use it in this query
index=wholesale_app CustomAnalytic Properties.index=1|rex "accountId\\":\\"(?<extref>[^\\]+)"|stats count by extref
with this error message
Error in 'rex' command: Encountered the following error while compiling the regex 'accountId\:\(?<extref>[^\]+)': Regex: missing terminating ] for character class
(scratches head).....what am I doing wrong?
Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.
Here's run-anywhere code...
| makeresults
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."
| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"
updated from
| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"
In this case, I used this construct [\\\\]
to represent a single escape character \ , and the construct [\\\"]
to represent a single quote ".
Figured it out, splunk requires more escaping of slash characters
Because the rex is in quotes, you need to escape the escape character(s) again, and then iterate testing it until it resolves.
Here's run-anywhere code...
| makeresults
| eval data = "{\"analyticType\":\"CustomAnalytic\",\"buildTarget\":\"blah\",\"clientSessionId\":\"DXFMLAF-CYTQQQK\",\"Properties\":{\"index\":1,\"args\":[\"{\\\"accountId\\\":\\\"exr244040\\\",\\\"customerId\\\":\\\"1001857\\\"}\"],\"category\":\"Event\"}}"
| rename COMMENT as "The above just enters your data as you posted it."
| rex field=data "accountId\\\\\":\\\\\"(?<accountId>[^\\\]+)"
updated from
| rex field=data "accountId[\\\\][\\\"]:[\\\\][\\\"](?<accountId>[^\\\"\\\\]+)[\\\\][\\\"]"
In this case, I used this construct [\\\\]
to represent a single escape character \ , and the construct [\\\"]
to represent a single quote ".
Thanks this worked for me
thanks DalJeanis!
I ended up with
rex "accountId.....(?<extref>[^\\\]+)"
Good job. Updated to the simpler version.