topic regex help in Splunk Search

regex help

gitingua — Fri, 26 Nov 2021 13:50:19 GMT

hello my friends.

how using regex can delete everything in bold

{"test": " { \n \"data\": \"check\",\n \"git_branch\": \"master\",\n \"git_repo_name\": \"reponame\",\n \"id\": 234,\n \"timestamp\": 16378522342,\n } "}

output

{ \"data\": \"check\", \"git_branch\": \"master\", \"git_repo_name\": \"reponame\", \"id\": 3413, \"timestamp\": 16378522342 }

Re: regex help

ITWhisperer — Fri, 26 Nov 2021 14:06:19 GMT

Does something like this work?

| rex mode=sed "s/\\n//g" | rex mode=sed "s/\{\"test\":\s*\"\s*//g" | rex mode=sed "s/\s*\"\}//g"

Re: regex help

Gr0und_Z3r0 — Sun, 28 Nov 2021 04:54:09 GMT

Hi @gitingua , if you want a clean JSON data, then you can try something like this...

| makeresults | eval jsonData ="{\"test\": \" { \\n \\\"data\\\": \\\"check\\\",\\n \\\"git_branch\\\": \\\"master\\\",\\n \\\"git_repo_name\\\": \\\"reponame\\\",\\n \\\"id\\\": 234,\\n \\\"timestamp\\\": 16378522342,\\n } \"}" | spath input=jsonData path=test output=result

Please vote up if it helps!