topic Re: How to extract field for statement. in Splunk Enterprise

How to extract field for statement.

jw44250 — Mon, 09 Apr 2018 19:37:39 GMT

serialNumber":"test1234","serviceChannel":"test","countryOfPurchase":"US",

serialNumber":"test1294","serviceChannel":"test","countryOfPurchase":"ind",

serialNumber":"test12836","serviceChannel":"test","countryOfPurchase":"ind",

serialNumber":"test125","serviceChannel":"test","countryOfPurchase":"chi",

how filter

serialNumber":"test1234"

using row in splunk

i have tried : but dint work

rex field=_raw "(?serialNumber.*)"

Re: How to extract field for statement.

kmaron — Mon, 09 Apr 2018 19:55:50 GMT

Try this:

| rex field=_raw "serialNumber\":\"(?<serialNumber>\w*?)\""

Re: How to extract field for statement.

jw44250 — Mon, 09 Apr 2018 20:14:49 GMT

No result found

Re: How to extract field for statement.

kmaron — Mon, 09 Apr 2018 20:23:43 GMT

What do you mean no result found? What is the rest of your search?

Re: How to extract field for statement.

jw44250 — Mon, 09 Apr 2018 20:45:16 GMT

index=text sourcetype=test | rex field=_raw "serialNumber\":\"(?\w*?)\"" |table serialNumber

Re: How to extract field for statement.

jw44250 — Mon, 09 Apr 2018 20:46:25 GMT

it returns empty result. it is in json format.

{serialNumber":"test12836","serviceChannel":"test","countryOfPurchase":"ind",}

Re: How to extract field for statement.

deepashri_123 — Tue, 10 Apr 2018 02:40:55 GMT

Hey jw44250,

Try using this:

| rex field=_raw "serialNumber\"\:\"(?P<SerialNumber>[^\"]+)\""

Let me know if this helps!!

Re: How to extract field for statement.

niketn — Tue, 10 Apr 2018 02:54:28 GMT

@jw44250, does the raw event contain only xml data? If so, you can set KV_MODE=JSON in your props.conf. Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#Alternatives_to_the_spath_command.

Also would it be possible for you to add complete JSON with sample/mocked up data? Are there multiple serialNumbers in single JSON or is there one serial number per JSON as in example from the question?

You should explore the spath command for traversing JSON Data. Following is a run anywhere search based on one of them:

|  makeresults
|  eval _raw="{\"serialNumber\":\"test12836\",\"serviceChannel\":\"test\",\"countryOfPurchase\":\"ind\"}"
|  spath

Re: How to extract field for statement.

mayurr98 — Tue, 10 Apr 2018 05:05:01 GMT

hello,

I am sure the answer given by @niketnilay should work but if you are looking to just extract serialNumber then you can go with the following query:

Try this run anywhere search

| makeresults 
| eval _raw="{\"serialNumber\":\"test12836\",\"serviceChannel\":\"test\",\"countryOfPurchase\":\"ind\"}" 
| rex "serialNumber\":\"(?<serialNumber>[^\"]+)"

In your environment, you should try

<base query> | rex "serialNumber\":\"(?<serialNumber>[^\"]+)"

let me know if this helps!

Re: How to extract field for statement.

jw44250 — Tue, 10 Apr 2018 15:15:25 GMT

Getting this below error
Error in 'rex' command: Encountered the following error while compiling the regex 'serialNumber":"(?P[^"]+)"': Regex: unrecognized character after (?P

Re: How to extract field for statement.

jw44250 — Tue, 10 Apr 2018 15:16:09 GMT

I want to run Ad hac command.

Re: How to extract field for statement.

jw44250 — Tue, 10 Apr 2018 16:58:29 GMT

My json: searchBase | spath output=myfield path=test |table myfield

The above query should work but not working..

{
"foo" : {
"bar" : [
{"zoo" : 1},
{"baz" : 2}
]
}
"test": 134
},
{
"foo" : {
"bar" : [
{"zoo" : 1},
{"baz" : 2}
]
}
"test": 139
}

Re: How to extract field for statement.

jw44250 — Tue, 10 Apr 2018 17:14:34 GMT

When u have json and text together it ownt work

This is my json from server .....
{
"foo" : {
"bar" : [
{"zoo" : 1},
{"baz" : 2}
]
}
"test": 134
},
{
"foo" : {
"bar" : [
{"zoo" : 1},
{"baz" : 2}
]
}
"test": 139
}

Re: How to extract field for statement.

kmaron — Tue, 10 Apr 2018 17:36:50 GMT

if you use an spath before the rex it should work. (it does for me)

Re: How to extract field for statement.

niketn — Wed, 11 Apr 2018 05:49:47 GMT

@jw44250, the JSON you have posted seems to be having incorrect structure (only first part can be traversed, Validate with any JSON Editor):

|  makeresults
|  eval _raw="{
\"foo\" : {
\"bar\" : [
{\"zoo\" : 1},
{\"baz\" : 2}
]
}
\"test\": 134
},
{
\"foo\" : {
\"bar\" : [
{\"zoo\" : 1},
{\"baz\" : 2}
]
}
\"test\": 139
}"
|  spath

Following is the correct structure for JSON

|  makeresults
|  eval _raw="{
    \"test1\":{
        \"foo\" : {
            \"bar\" : [
                        {\"zoo\" : 1},
                        {\"baz\" : 2}
                    ]
            },
        \"test\": 134
    },
    \"test2\":{
        \"foo\" : {
            \"bar\" : [
                        {\"zoo\" : 1},
                        {\"baz\" : 2}
                    ]
            },
        \"test\": 139
    }
}"
|  spath

If rectifying the JSON is out of question, you should use rex to extract required field based on Regular Expression.

Re: How to extract field for statement.

niketn — Wed, 11 Apr 2018 05:52:17 GMT

Can you try the following rex if you need to extract the multi-valued test field | rex "\"test\"\:\s(?<test>\d+)" max_match=0

|  makeresults
|  eval _raw="{
\"foo\" : {
\"bar\" : [
{\"zoo\" : 1},
{\"baz\" : 2}
]
}
\"test\": 134
},
{
\"foo\" : {
\"bar\" : [
{\"zoo\" : 1},
{\"baz\" : 2}
]
}
\"test\": 139
}"
|  rex "\"test\"\:\s(?<test>\d+)" max_match=0

Re: How to extract field for statement.

deepashri_123 — Wed, 11 Apr 2018 05:56:10 GMT

I have edited my answer... can u try now?

Re: How to extract field for statement.

TISKAR — Wed, 11 Apr 2018 09:31:54 GMT

Hello,

If you try this:

  | makeresults | eval _raw="\"serialNumber\":\"test1234\",\"serviceChannel\":\"test\",\"countryOfPurchase\":\"US\""
    | rex field=_raw "\"serialNumber\":\"(?<serialNumber>\w*)"
    | table serialNumber

In any case you can use Field Extractor UI
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ExtractfieldsinteractivelywithIFX