topic To extract string value using regex in Splunk Search

To extract string value using regex

parthiban — Mon, 04 Mar 2024 11:16:43 GMT

Hi Team,

I want to extract the below field value, here the challenge is the error code 403 sometimes it will change.

"processing_stage": "Getting a response of 403 from CRM Lead"

Kindly help me to extract the message using regex or any option available.

Re: To extract string value using regex

gcusello — Mon, 04 Mar 2024 11:25:11 GMT

Hi @parthiban,

if the message string is fixed, you could try:

<your_search> | rex "\"Getting a response of (?<response>\d+)" | table ...

you can test this regex at https://regex101.com/r/mz4c1L/1

Ciao.

Giuseppe

Re: To extract string value using regex

parthiban — Mon, 04 Mar 2024 12:14:41 GMT

Hi @gcusello

It is not working as expected, I need to extract full string

Re: To extract string value using regex

gcusello — Mon, 04 Mar 2024 13:30:00 GMT

Hi @parthiban,

you hughlighted only the 403 response code, if you want the full string, you could use:

| rex "\"processing_stage\": \"(?<response>[^\"]+)"

that you can test at https://regex101.com/r/mz4c1L/2

Ciao.

Giuseppe