topic Re: help with backslash in Splunk Search

help with backslash

curiousvivek — Tue, 27 Apr 2021 22:50:08 GMT

{ \\\"person\\\":{\\\"name\\\":{\\\"firstName\\\":\\\"John\\\",\\\"lastName\\\":\\\"Doe\\\"},\\\"address\\\":{\\\"street\\\":\\\"100 Main Ave\\\",\\\"city\\\":\\\"Redwood City\\\",\\\"usState\\\":\\\"CA\\\",\\\"zipCode\\\":\\\"94061\\\",\\\"country\\\":\\\"United States\\\",\\\"phones\\\":[],\\\"emails\\\":[],\\\"addressLines\\\":[]},\\\"addresses\\\":[],\\\"phones\\\":[{\\\"phoneType\\\":\\\"Home\\\",\\\"phoneNumber\\\":\\\"6500000000\\\"}],\\\"email\\\":\\\"johndoe@gmail.com\\\",\\\"dateOfBirth\\\":\\\"1900/01/01\\\",\\\"nationalId\\\":\\\"100\\\",\\\"gender\\\":\\\"Male\\\"},\\\"credential\\\":{\\\"userName\\\":\\\"johndoe@gmail.com\\\",\\\"password\\\":\\\"Password\\\",\\\"securityQuestion\\\":\\\"Name of First Car?\\\",\\\"securityAnswer\\\":\\\"Volvo\\\"}\"" }

I need help in getting email in splunk search query for above json which has blackslash in logs. I have grabbed the nametag from very big log json using spath and i am calling that tag as "nametagforthisjson" to simplify.

I tried this :

| rex field=nametagforthisjson max_match=0 "\"email:\\\\\\\":\\\\\\\"(?<email>.*)\"(?=,)" | table email

I see email label printed but not value . So my regex is wrong. the email value johndoe@gmail.com is for email name tag . So the value is until semicolon (,) . I am putting 7 blackslash.(2 backslash for 1 \ and 1 for ")
regex query version https://regex101.com/r/8BevNW/1

Re: help with backslash

ITWhisperer — Tue, 27 Apr 2021 22:47:42 GMT

Have you tried replacing \\ with nothing and \" with ", then use spath to extract the field you want?

Re: help with backslash

curiousvivek — Wed, 28 Apr 2021 00:49:00 GMT

Thanks,I did this :

| eval formattedjson = replace(nametagforthisjson,"\\\\", "")| table formattedjson

that but now i have json enclosed in double quotes

[see below]

"{ "person": { "name": { "firstName": "John", "lastName": "Doe" }, "address": { "street": "100 Main st", ... "phones": [ ], "emails": [ ], "addressLines": [ ] }, "addresses": [ ], "phones": [ { "phoneType": "Mobile", "phoneNumber": "65000000" } ], "email": "johdoe@gmail.com", .... } }"

What should I do to remove this enclosing double quotes?
Once this is success, I want to do
eval email = json_extract('formattedjson',"person.email")

Re: help with backslash

ITWhisperer — Wed, 28 Apr 2021 07:47:48 GMT

| eval formattedjson = trim(replace(nametagforthisjson,"\\\\", ""),"\"") | spath field=formattedjson path=person.email output=email | table formattedjson, email