topic Re: Rex field list of strings in Splunk Search

Rex field list of strings

tjdevries — Wed, 24 Nov 2021 14:50:28 GMT

How do I extract all values from a json file containing a list with multiple strings with rex?

The content of the field contains a list and a variable in stringform.

The number of items in the list can vary and the length of items also.

The field is as follows:

"{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}

In sofar, I was able to extract the field name with the following query.

| rex field=field.subfield.body max_match=0 "\"name\"\:\"(?<name>[a-zA-Z]+)\""

Variable 2 is a list with multiple strings and this leaves me puzzled. It's not the expression to recognize the strings in the list, but I'm looking for a way to look inside the list, look for two different patterns and find all items in it.

Can someone help out?

Re: Rex field list of strings

richgalloway — Wed, 24 Nov 2021 15:15:29 GMT

May I suggest extracting the fields with rex and then parsing them in a separate command? Perhaps this will get you started.

| makeresults | eval _raw="{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}" ```Above just sets up test data``` | rex "variable2\\\":\[(?<variable2>[^\]]+)],\\\"name\\\":\\\"(?<name>[a-zA-Z]+)" | eval variable2=split(variable2,",") ...

Re: Rex field list of strings

yuanliu — Thu, 25 Nov 2021 23:55:28 GMT

With structured data like JSON, it is less desirable to use Rex for extraction. Have you considered spath instead?

| makeresults ``` emulation ``` | eval myfield = "{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}" | spath input=myfield

Re: Rex field list of strings

tjdevries — Tue, 30 Nov 2021 08:37:53 GMT

Not yet but it looks a good approach to look into.

Re: Rex field list of strings

tjdevries — Tue, 30 Nov 2021 08:43:15 GMT

I managed to extract one field from the variable2-field. In some cases, it picks-up a 4-character-string, if a 6-character string is not present although I added match=0 to the query.

The cause looks that the order of the six-character and four-character strings within the list is unsorted. So this makes it more complicated.

Do you have a suggestion to approach this?

Re: Rex field list of strings

richgalloway — Tue, 30 Nov 2021 18:42:17 GMT

If the data is proper JSON, consider @yuanliu's suggestion and try the spath command.

I'm puzzled a bit by the latest response. The regex doesn't care about the size of the strings, it just pulls everything from between the square brackets that follow "variable2". Can you share actual events and search results (sanitized, of course)?