topic Re: regex works on regex101 but not splunk in Splunk Search

regex works on regex101 but not splunk

samneo — Fri, 17 Sep 2021 08:04:30 GMT

Im trying to get a regex to work in splunk that works in regex101

Im using the below regex

\b(a_msg)\b[^"]+"([^"]*)"

this will extract everything after a_msg field and in between the "". I want to save this as a field extraction. Any idea how i can get this to work?

example data

{"log":"a_level=\"INFO\", a_time=\"2021-09-17 07:33:35,210\", a_msg=\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\","level":"info"}

Re: regex works on regex101 but not splunk

kamlesh_vaghela — Fri, 17 Sep 2021 08:01:48 GMT

@samneo

Can you please share your sample data and configurations you are using?

Re: regex works on regex101 but not splunk

samneo — Fri, 17 Sep 2021 08:05:36 GMT

@kamlesh_vaghela Added to original post. There is no special configuration, i just want to be able to add it into field extraction via ui. We have splunk managed cloud so cannot amend from props.conf or any other backend

Re: regex works on regex101 but not splunk

kamlesh_vaghela — Fri, 17 Sep 2021 08:16:09 GMT

@samneo

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\", a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: regex works on regex101 but not splunk

samneo — Fri, 17 Sep 2021 08:48:54 GMT

this works perfectly,

thanks @kamlesh_vaghela