topic Re: Rex field extraction in Splunk Enterprise

Help with rex field extraction?

Allampally — Wed, 10 May 2023 22:33:25 GMT

Hi All,

I have two events as below. In both the events, data format is different. We can observe extra "/" from few events. How to capture the logEntryType from both of them by using rex command ?

,\"logEntryType\":\"SUMMARY\",
,"logEntryType":"Detail",

Field Name should be "logEntryType" and values should be "SUMMARY" and "Detail".

Re: Rex field extraction

ITWhisperer — Wed, 10 May 2023 13:04:53 GMT

This looks like JSON, the first string being embedded JSON (within another JSON field?) - have you tried using spath to extract the fields (It might need 2 spath's to extract the embedded JSON correctly)?

If you don't want to use spath (for whatever reason), the use of rex can get a little messy

| rex max_match=0 "\\\\?\"logEntryType\\\\?\":\\\\?\"(?<logEntryType>[^\"\\\\]+)"

Re: Rex field extraction

Allampally — Wed, 10 May 2023 13:26:01 GMT

I tried using SPATH but didn't work for me. Could you please help me to write two spaths to extract embedded json requests ?

Re: Rex field extraction

ITWhisperer — Wed, 10 May 2023 13:28:12 GMT

For that I would need an example of your events - please share anonymised version in a code block </> so that formatting is preserved.

Re: Rex field extraction

Allampally — Wed, 10 May 2023 14:18:03 GMT

I can't post even sample data here. Is there any link or tutorial to use spath for json requests ?

Re: Rex field extraction

ITWhisperer — Wed, 10 May 2023 15:52:39 GMT

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Spath