topic Extract user field from log? in Splunk Search

Extract user field from log?

user9025 — Mon, 17 Oct 2022 14:33:54 GMT

I have a log which looks like follow:

Request received :: Id assigned. --- Id=1, BODY={"userIds":["11"],"email":"test@test.com,"Client":"Test"}

The userids will always contains one element in the list surrounded by square brackets. So from above request I want to get 11. I am using rex to extract userID but seems that its not working.

index=prod-* sourcetype="kube:service" "Request received " | rex field=_raw "userIds\":\[\"(?<user_id>\d+)\"" |table user_id

But table is getting printed empty

Re: Extract user field from log

ITWhisperer — Sat, 15 Oct 2022 08:14:11 GMT

There doesn't appear to be anything wrong with what you are doing given the example you have shared. Perhaps the example doesn't accurately represent your actual data? Can you share some obfuscated real events?

Re: Extract user field from log

user9025 — Sat, 15 Oct 2022 15:44:40 GMT

the events shared are reals, with some fields obfuscated, I am able to extract events, but putting them in table is coming up empty

Re: Extract user field from log

user9025 — Sat, 15 Oct 2022 15:51:34 GMT

do we need to extract json variable BODY first from logs and then do it?

Re: Extract user field from log

yuanliu — Sun, 16 Oct 2022 04:26:29 GMT

In a way yes, because you should not try to manage structured data like JSON using pure text manipulation like rex. On the other hand, if your data source is configured normally, you should already have a field named BODY. If not, you can use kv aka extract.

Once you verify that BODY is extracted, use spath to extract structured fields.

| spath input=BODY