topic Re: Would you create rex or regex to extract a string and create a new field? in Splunk Search

Would you create rex or regex to extract a string and create a new field?

dwong2 — Wed, 27 Jun 2018 21:20:54 GMT

I have the raw data below. How do I get the strings after the "action": and put all the results into a new field?

{"dateTime":"2018-03-19T05:57:46.3002859Z","ID":"b3f7","account":"9002",xd":"859","action":"Exit"}
{"dateTime":"2018-03-19T05:57:47.1102859Z","ID":"cbbf","account":"f295",xd":"f89","tile":"HeroTile","action":"page:http://first.com/roomV8.2/front.main/"}

{"dateTime":"2018-03-19T05:57:46.3002859Z","ID":"b3f7","account":"9002",xd":"859","action":"Exit"}
{"dateTime":"2018-03-19T05:57:47.1102859Z","ID":"cbbf","account":"f295",xd":"f89","tile":"HeroTile","action":"page:http://second.com/roomV8.2/front.main/"}

Re: Would you create rex or regex to extract a string and create a new field?

hos_2 — Wed, 27 Jun 2018 21:58:29 GMT

Hi dwong2,

Try it in https://regex101.com/

"action":"(?<test>\w+|.+)"

Basically you want to tell regex to search for "Action" and group any of the results into a field we can call on later, which in this example I named "test".

Re: Would you create rex or regex to extract a string and create a new field?

amiftah — Wed, 27 Jun 2018 22:06:52 GMT

Did you miss a quote after "page:?
Can you show what's after page:? can action have multiple values separated by :?

Re: Would you create rex or regex to extract a string and create a new field?

ddrillic — Wed, 27 Jun 2018 22:27:13 GMT

Is there a way to convert the : to = in the log file?

Re: Would you create rex or regex to extract a string and create a new field?

hos_2 — Wed, 27 Jun 2018 22:32:25 GMT

If there is more data after page: then use this:

"action":"(?<test>\w+|.+)"

This will grab everything inside the quotes

Re: Would you create rex or regex to extract a string and create a new field?

dwong2 — Wed, 27 Jun 2018 22:43:19 GMT

If i wanted to search for this instead "action":"page: ?

Re: Would you create rex or regex to extract a string and create a new field?

amiftah — Thu, 28 Jun 2018 01:28:53 GMT

@ddrillic you can use the sed command to replace : by = :
| rex field=_raw mode=sed "s/:/=/g"

Re: Would you create rex or regex to extract a string and create a new field?

ddrillic — Thu, 28 Jun 2018 13:56:21 GMT

So, great, we can replace the : with = and then the fields should be automatically detected.

Re: Would you create rex or regex to extract a string and create a new field?

hos_2 — Thu, 28 Jun 2018 17:00:31 GMT

This will work much better and faster then my previous regex.

Re: Would you create rex or regex to extract a string and create a new field?

j_cabanillas — Fri, 20 Jul 2018 17:43:58 GMT

Add this to your search

index=my index  |rex field=source "\"action\":\"(?<action>[^\"]+)" |

If you don't want to get the action=Exit let me know

Re: Would you create rex or regex to extract a string and create a new field?

j_cabanillas — Fri, 20 Jul 2018 17:46:28 GMT

you can do the same for other fields constants like dateTime ID account