topic rex from the multivalue fields and get one particular value in Splunk Search

rex from the multivalue fields and get one particular value

mikeyty07 — Mon, 16 Oct 2023 14:41:28 GMT

I have this multivalue fields where i am tring to rex and get particular field value like
"value":"ESC1000", but instead getting multiple.
Tried with this but shows all the fields value
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"

"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]

Is there a way to get the required fields value only like above?

Re: rex from the multivalue fields and get one particular value

somesoni2 — Mon, 16 Oct 2023 15:07:06 GMT

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

Re: rex from the multivalue fields and get one particular value

mikeyty07 — Mon, 16 Oct 2023 16:14:09 GMT

Also i have this url which has
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create

is there a way to regex and get these?
1015953 as customerId
58870 as productId

Re: rex from the multivalue fields and get one particular value

somesoni2 — Mon, 16 Oct 2023 18:44:16 GMT

Try like this (UPDATED)

| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"

Re: rex from the multivalue fields and get one particular value

mikeyty07 — Mon, 16 Oct 2023 18:18:04 GMT

uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields

Re: rex from the multivalue fields and get one particular value

somesoni2 — Mon, 16 Oct 2023 18:44:46 GMT

I missed a colon in the regex. Added just now. Try the updated version.

Re: rex from the multivalue fields and get one particular value

mikeyty07 — Mon, 16 Oct 2023 19:16:35 GMT

thank you got the expected results