topic Re: Should be simple but it's not for me regex in Splunk Search

Should be simple but it's not for me regex

dcase9999 — Fri, 19 Jan 2024 18:27:59 GMT

Hi,

I have the below string and I'm trying to extract out the downstream status code by using this expression. I used to do this a long time ago but it appears those brain cells have aged out.

Regex that works in regex 101 but not Splunk

rex "DownstreamStatus..(?<dscode>\d+)"|stats count by dscode

String

{"ClientAddr":"blah","ClientHost":"blah","ClientPort":"50721","ClientUsername":"-","DownstreamContentSize":11,"DownstreamStatus":502,"Duration":179590376953,"OriginContentSize":11,"OriginDuration":179590108721,"OriginStatus":502,"Overhead":268232,

Re: Should be simple but it's not for me regex

dcase9999 — Fri, 19 Jan 2024 19:11:17 GMT

argh!!! Stupid me forgot the field argument....... Now it works, sorry everyone.

Re: Should be simple but it's not for me regex

yuanliu — Fri, 19 Jan 2024 22:18:04 GMT

Although you can get rex to work to some extent, treating structure data such as JSON as string is not robust. I always recommend changing to Splunk's tested builtin functions such as spath or fromjson.

If your event is JSON, Splunk should have given you the data field unless there's some serious problem with event parsing. If the string snippet is part of a data field that contains compliant JSON, say data, just do

| spath input=data

If the snippet is not in a field yet, use rex to extract the entire compliant JSON, then use spath. You will have much better data to work with.