topic Re: rex a string from text in Splunk Search

rex a string from text

dacamargov — Mon, 03 Aug 2020 18:25:58 GMT

How do I extract the cities from this text?

\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2...

I tried to compute the following query: ... | rex field=city "city: (?<America>)" | top limit=20 city

Thanks!

Re: rex a string from text

richgalloway — Mon, 03 Aug 2020 18:54:27 GMT

This should work

| rex max_match=0 "\/(?<city>\w+)" | mvexpand city

Re: rex a string from text

dacamargov — Mon, 03 Aug 2020 19:02:58 GMT

Did not work, I want to create an extra coulum "city" from the sample text containig: Sao_Paulo and Brasilia

Re: rex a string from text

richgalloway — Mon, 03 Aug 2020 19:23:24 GMT

It works on my test system.

Re: rex a string from text

to4kawa — Mon, 03 Aug 2020 19:38:45 GMT

If your log is JSON, please _raw text. not your modified samples.

Re: rex a string from text

dacamargov — Mon, 03 Aug 2020 19:47:06 GMT

How it will be writen using the "America" string before? I really need to use it as I put in the example, sorry for dont say that before.

ps: It is beacuse the real text is huge and then matching with /\ will not works, have to be with the "America" word before it.

Re: rex a string from text

richgalloway — Mon, 03 Aug 2020 20:05:11 GMT

I didn't assume all of the cities are in the Americas when I made the example. To fix it, just put "America" in the regular expression.

Re: rex a string from text

dacamargov — Tue, 04 Aug 2020 13:05:03 GMT

hey guys, here the real sample:

{\"dialog_node\"😕"node_1_1512565351738\",\"title\"😕"TAG_TEL_2.1.01_xingamentos - Ofensas - Nós de transferência\",\"conditions\"😕"intents[0].confidence > 0.7\"}],\"log_messages\":[]},\"context\":{\"CONTENT_OMITTEDa\":{\"CONTENT_OMITTEDt\"😕"NextChatV1\"},\"conversation_id\"😕"d4d7e1fa-7ecc-4eed-b496-f6a24d0c52fa\",\"system\":{\"initialized\":true,\"dialog_stack\":[{\"dialog_node\"😕"node_1_1512565351738\"}],\"dialog_turn_counter\":18,\"dialog_request_counter\":18,\"_node_output_map\":{\"Welcome\":[0],\"node_4_1545219778942\":[0,0],\"node_6_1506019673483\":[0],\"node_10_1586976201933\":{\"0\":[0]},\"response_89_1586976254180\":{\"0\":[0]},\"node_85_1586976254180\":{\"0\":[0]},\"node_1_1507049882219\":[0],\"response_202_1586977011758\":[0],\"response_192_1586977011758\":{\"0\":[0]},\"response_186_1586977011758\":{\"0\":[0]},\"node_182_1586977011758\":{\"0\":[0]},\"node_1_1560349134258\":[0],\"node_1_1516808150030\":[0,2,1,0],\"node_1_1512565351738\":[0]},\"branch_exited\":true,\"branch_exited_reason\"😕"fallback\"},\"algar\":true,\"counter\":1,\"holidays\"😕"[\\\"11/06/20\\\"]\",\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"lastTopicname\"😕"\",\"threshold_counter\":1,\"transfer_agent_counter\":1,\"teste_oferta_credito_inicio\":false,\"jornada_strut\"😕"next0_geral_-_-_ofensas\"}}","headers":"{content-length=[2036], content-type=[application/json;charset=UTF-8], date=[Mon, 03 Aug 2020 13:48:38 GMT], server=[Apache-Coyote/1.1], x-server_address=[::ffff:10.215.42.116]}","params":null,"status":200,"processingTime":531}

it is one of many, each one is a log containing that info... I am interested in extract the geolocation of them...

Thanks for the help!

Re: rex a string from text

thambisetty — Tue, 04 Aug 2020 13:59:38 GMT

this works in regex101

| rex "timezone\\(.*?)\/(?<city>[^\\]+)"

- working in Splunk

| rex "timezone\\\(.*?)\/(?<city>[^\\\]+)"

upvote if this works