Hi,
I have the following regex which works on regex101, but gives me an error when I try and use this within a Splunk query. Not sure if it's the fact that Im trying to escape the backslash that's causing the issue.
I have the field;
"UserName\a123456"
And I want to extract this into a field called NewUserName where it equals everything after the \ and up to closing quotes. So
NewUserName should be;
a123456
As I said, it works on Regex101 with the following;
"ADMIN\\*(?P[^"]*)"
But when I try it in Splunk via;
| rex field=_raw "ADMIN\\*(?P[^"]*)"
I get the error;
Mismatched ']'
Any ideas?
↧