topic Re: Help with Rex field-extraction in Splunk Search

Help with Rex field-extraction

d00680245 — Thu, 28 Apr 2022 13:54:08 GMT

I'm having a difficult time extracting the value for reportId. I'm not sure how to find the digits to the right of "reportId":
The reportId value has a range between 5 to 9 digits. I basically want to find anything between "reportId": AND ,
I've tried Splunk Field-Extractor and many similar examples on answers, but just cannot seem to get anything working.

raw sample data:

2015-05-28 08:27:19,378 INFO com.test.test.reports.Generation.ReportImageServiceListener - message received: {"location":"1","area":1,"Symbol":" LT","Number":"12345","Ids":[1.0,2.0,6.0],"Category":"ALL","reportLevel":"FIELD_GROUP","reportDelivery":"EMAIL_BUNDLE","reportType":"FORM","reportLayout":"LANDSCAPE","Year":2015,"userId":50000,"reportId":0000001,"layers":["CLU_BOUNDARIES","TEST_CLU_BOUNDARIES","ASSOCIATED_LABELS","CLU_LABELS","ASSOCIATED_CLUS","ANNUAL_CLUS","TEST_ACRES_CLUS","POLYGONS","AERIAL_IMAGERY","COUNTIES","PLSS","ROADS","TOWNS","WATERWAYS"],"plantedReport":false,"CluLabelOne":"FSN","FieldLabelFour":"NONE","FieldDisplayOption":"ALL","CluLabelThree":"FIELD","CluLabelTwo":"TRACT","FieldLabelOne":"LABEL","FieldLabelTwo":"ACRES","CluLabelFour":"FIELD_ACRES","FieldColorOption":"CROP","CluLabelFive":"PLANTED_ACRES","FieldLabelThree":"NONE","FieldYieldOption":"CURRENT_USE","FieldLabelFive":"NONE"}

Re: Help with Rex field-extraction

richgalloway — Thu, 28 May 2015 14:23:25 GMT

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)

Re: Help with Rex field-extraction

d00680245 — Thu, 28 May 2015 15:07:11 GMT

Thank you! This works for me! I was using www.regexr.com and plugged your solution in there and doesn't seem to work, but I'll definitely try out regex101.com.

Re: Help with Rex field-extraction

richgalloway — Thu, 28 May 2015 15:10:09 GMT

The biggest advantage (IMO) that regex101 has over regexr is support for the same regex syntax as Splunk.

Re: Help with Rex field-extraction

rsennett_splunk — Thu, 28 May 2015 16:11:12 GMT

regexr.com was my first love... and then I discovered that regex101.com understands the named capturing groups where the former does not. it's also nice to be able to save and share your regex with a link.

Re: Help with Rex field-extraction

Michael_Wilde — Fri, 29 May 2015 01:10:49 GMT

You might consider making a bit more of a generic regex so you can use it with other fields. If you just tell splunk "after this stuff, grab anything thats inside the quotes.. or grab anything before this comma" you might use that regex on other fields too! Like this:

 | rex "reportId\"\:(?<reportId>[^,\"]+)"

Inside that regex, I'm looking for a single character list, but the ^ "caret" negates it, so it says "anything that is not a comma, or a quote".. and then we repeat that as many times as we can with the "+" plus sign. Make a slight change to the preceding characters and the field name and use the same internal regex, like this:

| rex "reportLayout\"\:\"(?<reportLayout>[^,\"]+)"