topic Re: rex need help in Reporting

rex need help

bhaskar5428 — Thu, 18 Jul 2024 06:26:28 GMT

message: Send async response via rest [url=https://prd.ase1.dbktp-feedloader.prd.gcp.db.com/callbackservice/book, asyncResp={"transactionItems":[{"itemId":"KTPACC1_20240717000001633206_01","status":"FAILED","accountIdentification":{"gtbCashAccount":{"branchCode":"788","accountNumber":"0191395050","currencyCode":"USD"}}},{"itemId":"KTPACC1_20240717000001633206_02","status":"FAILED","accountIdentification":{"gtbCashAccount":{"branchCode":"788","accountNumber":"0000195054","currencyCode":"USD"}}}],"orderStatusResponse":{"orderStatus":"ORDER_FAILURE","orderId":"KTPACC1_20240717000001633206"},"error":{"errorCode":"SEP013","errorDescription":"Cannot find IDMS-0788 account by accNumber: 0000195054"}}]

==================================================================================

am using below query but its not giving me output , any idea
index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE
| fields message
| rex field=message \"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\"
| dedup errorCode
| table errorCode
=====================================================================

However syntax showing correct on https://regex101.com/r/XkBntG/1

Re: rex need help

gcusello — Thu, 18 Jul 2024 06:32:16 GMT

Hi @bhaskar5428 ,

yes the regex is correct, but you need to put a quote before and after the regex in the rex command:

index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE | fields message | rex field=message "\"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\"" | dedup errorCode | table errorCode

otherwise the rex command gives an error.

ciao.

Giuseppe

Re: rex need help

gcusello — Thu, 18 Jul 2024 06:43:00 GMT

Hi @bhaskar5428 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: rex need help

PickleRick — Thu, 18 Jul 2024 09:36:28 GMT

Adding to @gcusello 's answer.

A quote is not in itself a special character within a regex so within the regex itself it doesn't have to be escaped - on regex101 you could just do

 "error":\{"errorCode":"(?<errorCode>[^"]+)"

(In this case you could also get away with not escaping the opening brace but it doesn't hurt and prevents accidental not-escaping when needed).

But as you're putting the regex in a string as part of the command - then you need to escape your quotes as part of the string so the strings are not interpreted as the end of string. That's why you end up with (notice double backslash before opening brace - you also need to escape the backslash if you want it to be literally included in the string)

"\"error\":\\{\"errorCode\":\"(?<errorCode>[^\"]+)\""