REGEX problem

splunklearner — Wed, 19 Feb 2025 07:41:48 GMT

Please help me in extracting only compression values from this raw event -

"response_time_last_byte":5,"compression_percentage":0,"compression":"NO_COMPRESSION_CAN_BE_COMPRESSED","client_insights":"","request_headers":577,"response_headers":13,"request_state":"AVI_HTTP_REQUEST_STATE_SEND_RESPONSE_BODY_TO_CLIENT",

"response_time_last_byte":1,"compression_percentage":0,"compression":"","client_insights":"","request_headers":3,"response_headers":12,"request_state":"AVI_HTTP_REQUEST_STATE_READ_CLIENT_REQ_HDR",

Tried this but it is extracting client insights as well. I need to exclude all compression string values by writing SEDCMD

Re: REGEX problem

livehybrid — Wed, 19 Feb 2025 07:46:08 GMT

Hi @splunklearner

Try using the following REGEX

\"compression\":\"([^\"]*)\"\,

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

topic REGEX problem in Splunk Search

REGEX problem

Re: REGEX problem