topic Re: Using rex simple-xml with javascript extensions in All Apps and Add-ons

Using rex simple-xml with javascript extensions

bmacias84 — Sun, 13 Jul 2014 23:30:45 GMT

Hello,

I am running into a problem where I am attempting to use rex command similar to the Custom Chart Overlay in Simple XML examples.

I know my search works in simple xml.



earliest=-2hr latest=now

| fields time_taken, cs_uri_stem, sc_status

| rex field=sc_status \"(?<200>2\d\d)\"

 |rex field=sc_status \"(?<300>3\d\d)\"

| rex field=sc_status \"(?<400>4\d\d)\"

| rex field=sc_status \"(?<500>5\d\d)\"

| rex field=cs_uri_stem \"(?<uri>/[\w\d]{0,13})\"

| eval uri=lower(uri) |bucket _time span=2m

| stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri

but in the following it doesnt



            <div id="base-search"

                 class="splunk-manager"

                 data-require="splunkjs/mvc/searchmanager"

                 data-options='{

                    "earliest_time": "-2@h",

                    "latest_time": "now",

                    "cache": "60",

                    "search": ".... earliest=-2hr latest=now

                                | fields time_taken, cs_uri_stem, sc_status

                                | rex field=sc_status \"(?&lt ;200&gt ;2\d\d)\"

                                | rex field=sc_status \"(?&lt ;300&gt ;3\d\d)\"

                                | rex field=sc_status \"(?&lt ;400&gt ;4\d\d)\"

                                | rex field=sc_status \"(?&lt ;500&gt ;5\d\d)\"

                                | rex field=cs_uri_stem \"(?&lt ;uri&gt ;/[\w\d]{0,13})\"

                                | eval uri=lower(uri) |bucket _time span=2m

                                | stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri"

                 }'>

What gives?

Thanks in advance

Re: Using rex simple-xml with javascript extensions

martin_mueller — Sun, 13 Jul 2014 23:34:38 GMT

Make sure you either escape the double quotes within the search string or use single quotes around it instead.

Re: Using rex simple-xml with javascript extensions

mathu — Mon, 14 Jul 2014 20:30:20 GMT

Use a backslash to escape the double quotes.
Single quotes don't work because of "data-options" which is already quoted with singles.

Re: Using rex simple-xml with javascript extensions

bmacias84 — Mon, 14 Jul 2014 23:24:56 GMT

Sorry I forgot to added the double backslash. The part that having problems is the rex extraction. It does nots like the html encoding of the greater/ less than symbols or the symbol.

Re: Using rex simple-xml with javascript extensions

mathu — Tue, 15 Jul 2014 05:50:20 GMT

can you post the resulting search (from the job inspector)?

Re: Using rex simple-xml with javascript extensions

bmacias84 — Thu, 17 Jul 2014 16:06:53 GMT

I would post the job inspector, but as soon I add regex it never makes it to the search manager.

Re: Using rex simple-xml with javascript extensions

lukeh — Tue, 24 Mar 2015 02:23:42 GMT

mathu has it, you have to use a backslash to escape the double quotes.

I also had to escape the existing backslashes in my regex:

| rex field=cst_ls_segment \"LS\\d+\\s+(?&lt;segment&gt;.*)\"

Cheers,

Luke.