topic Re: Proper Rex expression help in Splunk Search

Proper Rex expression help

nkavouris — Tue, 25 Feb 2025 16:27:45 GMT

I need help building a proper rex expression to extract the bold text from the following raw data

{"bootcount":8,"device_id":"XXXX","environment":"prod_walker","event_source":"appliance","event_type":"GENERIC","local_time":"2025-02-20T00:34:58.406-06:00",
"location":{"city":"XXXX","country":"XXXX","latitude":XXXX,"longitude":XXXX,"state":"XXXX"},"log_level":"info",
"message":"martini::hardware_controller: Unit state update from cook client target: Elements(temp: 500°F, [D, D, D, D, D, F: 0]), hw_state: Elements(temp: 500°F, [D, D, D, D, D, F: 115])\u0000",
"model_number":"XXXX","sequence":372246,"serial":"XXXX","software_version":"2.3.0.276","ticks":0,"timestamp":1740033298,"timestamp_ms":1740033298406}

I have tried;

rex field=message "(?=[^h]*(?:hw_state:|h.*hw_state:))^(?:[^\(\n]*\(){2}\w+:\s+(?P<set_temp>\d+)
rex field=message ".*hw_state: Elements\(temp:(?<set_temp>\d+),.*"|

with no results yielded. What is the proper rex expression to extract 500 from the message field

Re: Proper Rex expression help

gcusello — Tue, 25 Feb 2025 16:30:52 GMT

Hi @nkavouris,

please try this:

| rex "hw_state:\sElements\(temp:\s(?<temp>\d+)"

that you can test at https://regex101.com/r/FhThZf/1

Ciao.

Giuseppe

Re: Proper Rex expression help

nkavouris — Tue, 25 Feb 2025 16:38:12 GMT

Grazie giuseppe, but this does not work in splunk unfortunately

Re: Proper Rex expression help

gcusello — Tue, 25 Feb 2025 16:44:26 GMT

Hi @nkavouris ,

what's the behavior of this regex: it extract too data or nothing?

it seems to be correct using the sample you shared.

Anyway, this seems to be a log in json format, did you tried to use INDEXED_EXTRACTIONS=JSON or spath?

Ciao.

Giuseppe

Re: Proper Rex expression help

nkavouris — Tue, 25 Feb 2025 16:57:12 GMT

No data extracted at all, and the data is JSON formatted.

I normally start my rex expressions with field=message "(rex expression)"

Re: Proper Rex expression help

livehybrid — Tue, 25 Feb 2025 21:48:22 GMT

Hi @nkavouris

Is it just "500" you are expecting to extract?

Your second regex looks pretty close but you are missing the \s for the space after : and before 500 - and a couple of other tweaks. Does this work for you?

| rex field=message "Elements\(temp:\s(?<set_temp>\d+)"

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Proper Rex expression help

yuanliu — Wed, 26 Feb 2025 04:16:11 GMT

This is a JSON object (except you should add quotes to those bare XXXX). Do not use regex on structured data. See the other thread you started. Your search is inefficient because you use wildcard at the beginning of a term. And there's a solution to that.