Need Help in regex expression

rkishoreqa — Mon, 24 Jan 2022 17:35:38 GMT

Hi team,

I need to fetch the 'InterfaceName' from the below payload. I built a regular expression but it is not working as expression. Can someone please verify this and correct me where I am wrong.

"xmlns:bw":"http://www.tibco.com"
"ns:InterfaceName":"MIAP-COVGBA",
"ns:CorrelationID":"f84nvkdwe-4ij43kj"

I created one regex expression like - | rex field=_raw "ns:InterfaceName\W+(?<AppId>\w+)" |stats count by AppId.

From the above expression I am getting only double quotes ("), but unable to fetch data.

Thanks in advance.

yours,

...

Re: Need Help in regex expression

richgalloway — Mon, 24 Jan 2022 17:52:59 GMT

Here's an alternative regex to try.

ns:InterfaceName\\\":\\\"(?<AppId>[^\\\"]+)

topic Re: Need Help in regex expression in Splunk Search

Need Help in regex expression

Re: Need Help in regex expression