Field Extraction not working, need usable rex expression

nkavouris — Wed, 17 Jul 2024 14:36:57 GMT

I have a search that yields

"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257"

I am trying to extract the bold value associated with fuel, the value can be any number 0-1000 Using the field extractor I have gotten an unusable rex result:

rex message="^\{"\w+":\d+,"\w+_\w+":"[a-f0-9]+","\w+":"\w+_\w+","\w+_\w+":"\w+","\w+_\w+":"\w+","\w+":\{"\w+":"\w+","\w+":"\w+","\w+":\d+\.\d+,"\w+":\-\d+\.\d+,"\w+":"\w+"\},"\w+_\w+":"\w+","\w+":"\w+::\w+_\w+_\w+:\s+\w+:\s+\d+,\s+\w+:\s+\d+,\s+\w+_\w+:\s+\d+,\s+\w+:\s+\w+,\s+\w+:\s+(?P<fuel_level>\d+)"

When trying to search with this, the next command does not work and my result yields: Invalid search command 'a'

Can someone give me usable rex to get the highlighted number in a field titled 'fuel_level'

Re: Field Extraction not working, need usable rex expression

yuanliu — Wed, 17 Jul 2024 16:10:20 GMT

Please illustrate full message. The look of the fragment suggest your source is actually JSON, something like

{"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"}

Is this correct? Using regex directly on structured data is strongly discouraged as any regex is doomed to be fragile.

If the JSON is raw event, Splunk would have already extracted a field called "message". Start from this field instead. This field also is structured as KV pairs. Use kv aka extract instead of regex.

| rename _raw as temp, message as _raw | kv kvdelim=": " pairdelim="," | rename _raw as message, temp as _raw | fields fuel

Your sample data would have given

fuel	_raw	_time
0	{"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"}	2024-07-17 09:06:35

Here is an emulation for you to play with and compare with real data

| makeresults | eval _raw = "{\"message\":\"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257\", \"foo\":\"bar\"}" | spath ``` data emulation above ```

topic Field Extraction not working, need usable rex expression in Splunk Search

Field Extraction not working, need usable rex expression

Re: Field Extraction not working, need usable rex expression