topic Re: I'm trying to extract field That looks like below in Splunk Search

I'm trying to extract field That looks like below

PavanSeerapu — Fri, 10 Sep 2021 19:23:22 GMT

I'm trying to extract field That looks like "Alert-source-key":"[\"abcdd-gdfc-mb40-a801-e40fd9db481e\"]"

I have tried this "Alert-source-key":"(?P<Alert_key>[^"]+)" but i'm getting results like "[/" since it is checking for only

Re: I'm trying to extract field That looks like below

richgalloway — Fri, 10 Sep 2021 20:25:53 GMT

What exactly are you trying to extract from that string? Where and how are you doing so?

If you're trying to extract the field using the rex command in a search then the embedded quotation marks must be escaped.

Re: I'm trying to extract field That looks like below

PavanSeerapu — Mon, 13 Sep 2021 12:27:35 GMT

What exactly are you trying to extract from that string? -- abcdd-gdfc-mb40-a801-e40fd9db481e

I'm using field extractor through splunk web and writing the regular expression by myself

Re: I'm trying to extract field That looks like below

richgalloway — Mon, 13 Sep 2021 12:32:33 GMT

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)

Re: I'm trying to extract field That looks like below

isoutamo — Mon, 13 Sep 2021 12:39:35 GMT

This seems to work

| makeresults | eval foo = "\"Alert-source-key\":\"[\\\"abcdd-gdfc-mb40-a801-e40fd9db481e\\\"]\"" | rex field=foo "\"Alert-source-key\":\"\[\\\\\"(?P<Alert_key>[^\"\\\]+)"

In this kind of cases there are needed "couple" of escapes \.

r. Ismo