topic Re: Regex Help in Splunk Search

Regex Help

tkerr1357 — Mon, 27 Apr 2020 17:15:06 GMT

Hello all,

I am new to regex and struggling to get the Actual value field. I only need the number in between the quotes as sometimes the number can be smaller or larger than the example in the event. Below is an example of what I was trying with no luck. Any help is appreciated.
| rex "\svalue\":(?\d+)"

Message={
"ApplicationId": "babe7022-5a00-4338-a519-0a5bbf5c64ee",
"ApplicationName": "Lacerte 2019",
"Measurement": "lacerteload_2019",
"Description": "Measurement duration (59.615s) exceeded threshold of 40s (49.04%)",
"Actual value": "59.615",

Re: Regex Help

richgalloway — Mon, 27 Apr 2020 17:30:08 GMT

Try | rex "value\\": \\"(?<actualValue>[^\\"]+)".

Re: Regex Help

tkerr1357 — Mon, 27 Apr 2020 17:44:15 GMT

no such luck. It returned Error in 'SearchParser': Missing a search command before '^'. Error at position '107' of search query 'search index="login_pi" source="WinEventLog:LoginP...{snipped} {errorcontext = (?[^\"]+)"}'.

Re: Regex Help

richgalloway — Mon, 27 Apr 2020 18:21:02 GMT

There was a typo and extra escape characters were needed. Try the updated answer.

Re: Regex Help

codebuilder — Mon, 27 Apr 2020 19:58:55 GMT

There is a often overlooked utility that is extremely useful for these type situations..."erex".

Run your existing search and pipe the results to erex, give the field a name, and provide an example value.

e.g.
| erex ApplicationId examples="babe7022-5a00-4338-a519-0a5bbf5c64ee"

When the search returns, go to the job inspector and it will provide the regex that Splunk used to find the value.
You can also use "counterexamples" to eliminate matches.

It's a very handy tool.

Documentation:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex