topic Re: Regular expression in Reporting

Help with regular expression to extract fields

vineela — Wed, 24 Aug 2022 14:35:18 GMT

I need to write regular expression to extract few fields in this, but not able to figure this out. Can you please help me on the same.

X-Response-Timestamp: 2022-08-24T07:27:26.150Z x-amzn-Remapped-Connection: close ... 4 lines omitted ... X-Amzn-Trace-Id: Root=1-6305d2de-69ec840431ff21182b4a9f68 Content-Type: application/json {"code":"APS.MPI.2019","severity":"FATL","text":"Invalid Request","user_message":"Request id has already used."}

Above is the whole log. I need to extract code,severity and message. I cant able t understand the format and fetch.

Re: Regular expression

gcusello — Wed, 24 Aug 2022 09:34:17 GMT

Hi @vineela,

this seems to be a Json log, so you could try to use the spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath).

If anyway you want to use a regex, you could try something like this:

| rex "\"code\":\"(?<code>[^\"]+)\",\"severity\":\"(?<severity>[^\"]+)\".*\"user_message\":\"(?<user_message>[^\"]+)\""

that you can test at https://regex101.com/r/8Ggre7/1

Ciao.

Giuseppe

Re: Regular expression

vineela — Thu, 25 Aug 2022 04:11:00 GMT

Hi gcusello,

It is working and thanks for introducing new command as well to me..I will try to check documentation for spath command.

Appreciate you for quick response

Re: Regular expression

gcusello — Thu, 25 Aug 2022 07:12:44 GMT

Hi @vineela,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉