Problem:
I am getting the following error when I tried to run the query with correct regex as below:
Error: The following errors were reported when executing your search:<br>Oops! Looks like we encountered a problem. Try running your query again. If the problem persists, please contact Support. [Error Code: CBVX7-DCGJ5-VQJGL] (500)
| parse regex "gc\s*] GC\(\d+\) Pause (?<type>\w+) (\((?<reason>[\w\s]+)\) )?(?<start>\d+)M->(?<end>\d+)M\(\d+M\) (?<ms>\d+)"
Solution:
1. Sumo Logic does not support unnamed capture groups. Groups should either be named capture groups or explicitly marked as a non-capturing group.
You can convert these easily by appending "?:" to the group right after the starting parenthesis.
For example:
| parse regex "gc\s*] GC\(\d+\) Pause (?<type>\w+) (?:\((?<reason>[\w\s]+)\) )?(?<start>\d+)M->(?<end>\d+)M\(\d+M\) (?<ms>\d+)"
Non-capturing group:
(?:\((?<reason>[\w\s]+)\) )?(?<start>\d+)M->(?<end>\d+)M\(\d+M\) (?<ms>\d+)
2. Also, Sumo Logic does not support nested named capture groups. So the outer groups in your regex need to marked explicitly as non-capturing groups. With that change, the regex works fine.
Reference: https://help.sumologic.com/Search/Search-Query-Language/01-Parse-Operators/02-Parse-Variable-Patterns-Using-Regex
Comments
0 comments
Please sign in to leave a comment.