topic Re: regular expressions - field extractions in Splunk Cloud Platform

How to extract regular expressions?

ranjithan — Mon, 25 Jul 2022 16:08:06 GMT

Hi ,

Need some help to extract regular expressions.

I have a set of unstructured logs . Part of the log is as shown below:

"RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"}

How would one extract 2022-07-25T11:19:29.0106873Z and assign it to field RequestUTCDateTime, .

This should be done whenever "RequestUTCDateTime" is encountered in the raw log.

Please help me.

Thank You,

Ranjitha N

richgalloway — Mon, 25 Jul 2022 13:03:34 GMT

You can extract the field at search-time using the rex command.

| rex "RequestUTCDateTime\\\":\\\"(?<RequestUTCDateTime>[^\\\"]+)"

Or it can be extracted automatically using an EXTRACT setting in props.conf:

EXTRACT-RequestUTCDateTime = RequestUTCDateTime":"(?<RequestUTCDateTime>[^"]+)

ranjithan — Mon, 25 Jul 2022 13:30:53 GMT

Thank You so much for the help!