Hi,
before Splunk 6.5 I used commands like this to split strings into separate fields.
For fields like **productId=abc_text_def**
| rex field=productId "(?.*)\_text_(?.*)"
Since 6.5 this does not work anymore. The error is:
Error in 'rex' command: Encountered the following error while compiling the regex '(?.*)\_text_(?.*): Regex: unrecognized character follows \
Can you help me to fix this?
↧