topic Hello, I need help to extract a value from a string in Splunk Search

Hello, I need help to extract a value from a string

flck — Sat, 03 Oct 2020 19:48:15 GMT

Hi everyone,

I hope someone can help me with the following situation.
I have multiple events generated from Azure Devops like the following:

{"system.pullRequest.pullRequestId":"223033","system.pullRequest.sourceBranch":"refs/heads/release","system.pullRequest.targetBranch":"refs/heads/master","system.pullRequest.sourceCommitId":"e000000a962ff66c19aacXXXXXXX4c7","system.pullRequest.sourceRepositoryUri":"https://siteXXX.visualstudio.com/XXXX%XXX%20ds%XXXX%C3%ADa/_git/AWXXX000","system.pullRequest.pullRequestIteration":"1"}

I am trying to extract the value that corresponds to the field "system.pullRequest.pullRequestId", for this example it is "223033", I have not been able to achieve it yet. Any idea how to do it?

For some events the field "system.pullRequest.pullRequestId" is not at the beginning of the string, it can be in the middle or at the end, the position varies with each event.

I appreciate any help you can give me.

Re: Hello, I need help to extract a value from a string

ITWhisperer — Sat, 03 Oct 2020 20:16:16 GMT

| rex "system\.pullRequest\.pullRequestId\":\"(?<pullrequestid>\d+)\""

Re: Hello, I need help to extract a value from a string

flck — Sat, 03 Oct 2020 23:28:08 GMT

Hi,

Thanks for your answer, I tested the rex and it only counts but it does not extract the field I need. Trying a little more I was able to extract it like this:

... | eval _raw = parameters | extract

Re: Hello, I need help to extract a value from a string

inventsekar — Sun, 04 Oct 2020 03:28:48 GMT

Hi @flck ..

may we know what output you get with this above rex query.