topic how to match value in events using Rex in Splunk Search

how to match value in events using Rex

james_n — Sun, 12 Apr 2020 16:47:14 GMT

Hi experts,

please help me with regular expression to match the value in each event at search time as shown below

:{\"buaid\":{\"business\":[\"12345\"],\"exclude*

required output: bss_value=12345

thanks in advance.

Re: how to match value in events using Rex

richgalloway — Sun, 12 Apr 2020 19:01:15 GMT

Try

business\\":\[\\"(?<bss_value>[^\\]+)\\

Re: how to match value in events using Rex

jpolvino — Sun, 12 Apr 2020 19:09:47 GMT

This might get you close, with a run anywhere example:

| makeresults | eval _raw=":{\\\"buaid\\\":{\\\"business\\\":[\\\"12345\\\"],\\\"exclude*"
| rex ":{\\\\\"buaid\\\\\":{\\\\\"business\\\\\":\[\\\\\"(?<bss_value>[^\\\]+)\\\\\"\],"

It sets up a _raw field, and then extracts from it. The last line should do it for you.

Re: how to match value in events using Rex

to4kawa — Sun, 12 Apr 2020 20:38:38 GMT

|rex "(?<bss_value>\d{5})"

This is enough.

Re: how to match value in events using Rex

james_n — Fri, 15 May 2020 04:24:35 GMT

Hi @jpolvino , thanks for the answer. its working fine. but if i have multiple values with , separated than its not working .Please help on this.

Ex: :{\"buaid\":{\"business\":[\"12345\",\"6789\"]