topic How to extract a field from my raw data using rex? in Splunk Search

How to extract a field from my raw data using rex?

alexspunkshell — Wed, 20 Apr 2022 15:27:33 GMT

Below is my raw logs.

I want to extract "analystVerdict" & its corresponding result from raw logs. can someone please help

\"mitigationStartedAt\": \"2022-04-13T03:57:58.393000Z\", \"status\": \"success\"}], \"threatInfo\": {\"analystVerdict\": \"false_positive\", \"analystVerdictDescription\": \"False positive\", \"automaticallyResolved\": false, \"browserType\": null, \"certificateId\": \"\", \"classification\": \"Malware\",

I tried below. But i am failing to get the result

index=test_summary | rex field=_raw ":\\\"(?<analystVerdict>\w+)\\\"" |table search_name analystVerdict

Re: Extract a field from my raw data using rex

gcusello — Wed, 20 Apr 2022 15:16:22 GMT

Hi @alexspunkshell,

please try this regex:

| rex "analystVerdictDescription\\\":\s+\\\"(?<analystVerdictDescription>[^\"]+)"

that you can test at https://regex101.com/r/IjwJYM/1

Ciao.

Giuseppe

Re: Extract a field from my raw data using rex

alexspunkshell — Wed, 20 Apr 2022 15:39:52 GMT

@gcusello Thanks for your help

I tried but the field is empty in my results. But the raw logs is having the values.

Re: Extract a field from my raw data using rex

isoutamo — Wed, 20 Apr 2022 15:38:42 GMT

If you really have that \ as an escape character on your data, you should add could of more \ character on your rex. There reason is that internally there are couple of places where splunk do that de-escaping and for that reason sometimes you need to do it double or triple times.

Re: Extract a field from my raw data using rex

gcusello — Wed, 20 Apr 2022 15:45:15 GMT

Hi @alexspunkshell,

sometimes I found a behaviour in Splunk different than regex101, so please try this:

| rex "analystVerdictDescription\\\\":\s+\\\\"(?<analystVerdictDescription>[^\"]+)"

Ciao.

Giuseppe

Re: Extract a field from my raw data using rex

alexspunkshell — Wed, 20 Apr 2022 15:48:17 GMT

Still the same

Re: How to extract a field from my raw data using rex?

ITWhisperer — Wed, 20 Apr 2022 15:54:03 GMT

| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"