topic Splunk Rex: Extracting fields of a string into a Column in Splunk Search

Splunk Rex: Extracting fields of a string into a Column

rczone — Wed, 30 Sep 2020 03:01:15 GMT

I'm a newbie to SPlunk REX trying to do some dashboards and need help in extracting fields of a particular variable
i read old articles in SPlunk old questions but couldn't figured it out..
Here in my case i want to extract only KB_List":"KB000119050,KB000119026,KB000119036" values to a column

Expected output: as a table

KB_Listed
KB000119050,KB000119026,KB000119036

i have tried:

| `rex field=_raw "KB_List\":\"(?<KB_List>[^\"])\""`

Message Snippet below:

svc_log_ERROR","Impact":4.0,"CategoryId":"94296c474f356a0009019ffd0210c738","hasKBList":"true","lastNumOfAlerts":1,"splunkURL":false,"impactedInstances":"","highestSeverity":"Minor","Source":"hsym-plyfss01","reqEmail":"true","AlertGroup":"TIBCOP","reqPage":"","KB_List":"KB000119050,KB000119026,KB000119036","reqTicket":"true","autoTicket":true,"SupportGroup":"TESTPP","Environment":"UAT","Urgency":4.0,"AssetId":"AST000000000159689","LiveSupportGroup":"TESTPP","sentPageTo":"TESTPP"},"Notification":{"":{"requestId":"532938335"}},""

Re: Splunk Rex: Extracting fields of a string into a Column

richgalloway — Tue, 19 Nov 2019 20:33:33 GMT

Try ... | rex "KB_List":"(?<KB_Listed>[^"]+)"

Re: Splunk Rex: Extracting fields of a string into a Column

rczone — Tue, 19 Nov 2019 20:50:03 GMT

Error in 'SearchParser': Mismatched ']'. @richgalloway

Re: Splunk Rex: Extracting fields of a string into a Column

rczone — Tue, 19 Nov 2019 20:53:53 GMT

tried this also rex "KB_List":"(?[^\"]+)" | table KB but no use

Re: Splunk Rex: Extracting fields of a string into a Column

mayurr98 — Tue, 19 Nov 2019 20:54:55 GMT

escape "

try :

| rex "KB_List\":\"(?<KB_Listed>[^\"]+)" | table KB_Listed

Re: Splunk Rex: Extracting fields of a string into a Column

rczone — Tue, 19 Nov 2019 20:59:24 GMT

@mayurr98 returning none ...

| rex "KB_List\":\"(?[^\"]+)" | table KB_list

Re: Splunk Rex: Extracting fields of a string into a Column

mayurr98 — Tue, 19 Nov 2019 21:02:50 GMT

try this:

.. | rex "KB_List\":\"(?<KB_Listed>[^\"]+)" | table KB_Listed

you are not putting the extracted value in the field. Copy the above query and run as it is.

Re: Splunk Rex: Extracting fields of a string into a Column

rczone — Wed, 30 Sep 2020 03:01:21 GMT

@mayurr98 | rex "KB_List\":\"(?[^\"]+)" | table KB_Listed this worked..thanks a ton