topic rex command in Splunk Dev

rex command

saifdj — Mon, 04 May 2020 10:58:53 GMT

How to fetch activity id using rex command

Log record:

DATA= {"note":"Succeeded | {\r\n \"service.url\": \"\",\r\n \"enable.debug\": false,\r\n \"permission.base.url\": \"\",\r\n \"userInfo.base.url\": \"\",\r\n \"storeId.base.url\": \"\",\r\n \"app.session.timeout\": 25\r\n},activityId: 64AB3318-4DA3-4D38-9800-5DABCC7EC263,","appVersion":"1.10"

I tried below query with no luck,

| rex field=DATA ",activityId: (?<ACTIVITY_ID_VALUE>.*)"

Trying to fetch value "64AB3318-4DA3-4D38-9800-5DABCC7EC263" and show in table

Re: rex command

PavelP — Mon, 04 May 2020 12:46:26 GMT

Hello @saifdj

please double check you that you have an extracted field DATA.

If not you can use a general regex applied to whole _raw event (which is not so effizient as you indended):

rex "activityId: (?<a1>[\w\-]+)"

Please let me know how if it worked

Re: rex command

cpetterborg — Mon, 04 May 2020 17:20:31 GMT

Slightly more generic (since it looks like a comma is the delimiter):

... | rex "activityId: (?<ACTIVITY_ID_VALUE>[^,]+)"