topic Re: Unable to create field using regex in Splunk Search

Unable to create field using regex

sagar_shubham — Wed, 29 Dec 2021 19:27:12 GMT

Hi Team,

Need your help in creating regex to create a field.

"User_Claim":("sub":"qweihaytej"; "login_id":"Abc@domain.com";........)

Here User_Claim is a field. I have to create a field for login_id.

I have tried with this, and it's not working.

..... | rex field=User_Claim " login_id"(? <loginID>\w+.) "

I am unable to see the field name in the interesting fields.

Please suggest in this.

Thanks

Sagar

Re: Unable to create field using regex

richgalloway — Wed, 29 Dec 2021 19:38:47 GMT

That regex has a few extra characters in it (and some missing ones) that prevent a match. Also, "\w+" won't match the full login_id field because of the "@" (which is not a word character). Finally, embedded quotation marks need to be escaped. Try this command:

| rex field=User_Claim "login_id\\\":\\\" \\\"(?<loginID>[^\\\"]+)"

Re: Unable to create field using regex

sagar_shubham — Thu, 30 Dec 2021 16:38:08 GMT

This is not working Sir.

Re: Unable to create field using regex

richgalloway — Thu, 30 Dec 2021 20:16:16 GMT

Meaning what, exactly? Please share the full query you tried, what results were expected, and what results you got.

Re: Unable to create field using regex

ashvinpandey — Fri, 31 Dec 2021 07:21:54 GMT

@sagar_shubham Try using the below rex:

| rex field=_raw "login_id\"\:\"(?P<login_id>.*?)\""

Also if this reply helped you in solving your problem an up-vote would be appreciated 👍