Help with Regex?

MrIncredible — Tue, 03 Jan 2023 16:08:07 GMT

I have a field "facilityAlias" for which location can be changed in every api log file. I have to extract that field using Regex method. I have tried Regex statement but not getting expected result.

Regex statement: rex field=_raw "facilityAlias\":\"(?<facility>.*)\","

expected result: Parc de Salut Mar Barcelona
current result: Parc de Salut Mar Barcelona","systemName":"CMPSB

Sample Log file:

sample log: 2023-01-02 23:36:58,521 [[MuleRuntime].uber.3869: [abcd-message-kdhskhdsk-api].Delete_msg_from_queue.BLOCKING @27fe0275] INFO com.skdhksh.jsdhjshd.hsd.logging.internal.CustomLoggerOperations - {"environment":"stag36rcf_eu-env","applicationName":"abcd-message-kdhskhdsk-api","correlationId":"kshddhks-3o4u-jshd8-aksdbkadkahd","apiProcessingTime":347,"totalProcessingTime":740,"tracePoint":"END","logMessage":"{\n \"url\": \"abcd\",\n \"bucketName\": \"dipeus-data-store\",\n \"s3versionID\": \"shdkshdkshdkshdkshdkshdkjshd\",\n \"s3key\": \"ljdljdlajldj]dsdsd\ksdjksjdksjdksjdksjksjd\ksdjksjd\"\n}","txnMetadata":{"bundleId":"ahsdkhsdh-skjdhshdkshd-skdhshdks-skdhkshd","messageType":"abcd","messageSubType":"kdshdkshdks","facilityAlias":"Parc de Salut Mar Barcelona","systemName":"CMPSB","transactionStartTime":1672702617781,"relatesToPatientMerge":false,"inputPayload":"adhkjshdkshdkshdkshd"},"apiStartTime":"1672702618174"}

Re: Need Help with Regex

gcusello — Tue, 03 Jan 2023 08:25:15 GMT

Hi @MrIncredible,

you can use:

| rex "facilityAlias\":\"(?<facility>.*)\",\"systemName"

or (better):

| rex "facilityAlias\":\"(?<facility>[^\"]*)"

that's more generic and you can test at https://regex101.com/r/jnbSgk/1 .

Ciao.

Giuseppe

Re: Need Help with Regex

MrIncredible — Tue, 03 Jan 2023 09:14:36 GMT

Many thanks @gcusello for your quick reply. 2nd option will work as in 1st option i don't want to restrict it with particular postfix.

topic Re: Need Help with Regex in Splunk Search

Help with Regex?

Re: Need Help with Regex

Re: Need Help with Regex