topic Re: How do I write a regular expression to extract 2 fields from my sample data? in Splunk Search

How do I write a regular expression to extract 2 fields from my sample data?

JoshuaJohn — Tue, 29 Sep 2020 11:01:07 GMT

So I have a search that will check if two variables equal a specific number, and then I get the count of these instances. I am having trouble regexing the numbers I needed to create the variables.

index=nitro_prod_ecomm errorCode |rex (This grabs the Response Code) | rex (This grabs Error Code) | where RespCode = 400 AND ErrorCode = 1001 | table count

REQUEST_BODY:
{profileId:0156",deviceId:D893-4324234234C"}
RESPONSE_CODE:400
RESPONSE_TIME:2
RESPONSE_HEADERS:
Date:Wed, 14 Sep 2016 15:10:17 GMT;
X-Powered-By:Servlet/3.0;
correlation-id:NAID-iOS-E6B4F6817.94320;
channel:IOS;
Content-Type:application/json;
Transfer-Encoding:chunked;
Connection:Close;
RESPONSE_BODY:
{"errors":[{"errorCode":"1001","message":""}]}

_WS_HAPRT_WLMVERSION:-1;
RESPONSE_CODE:500
RESPONSE_TIME:11
RESPONSE_HEADERS:
X-Powered-By:Servlet/3.0;
correlation-id:TID-14743243247;
Content-Type:application/json;
Transfer-Encoding:chunked;
Connection:Close;
Date:Wed, 14 Sep 2016 15:33:13 GMT;
RESPONSE_BODY:
{"errors":[{"errorCode":"1010","message":""}]}

Re: How do I write a regular expression to extract 2 fields from my sample data?

PPape — Wed, 14 Sep 2016 15:47:15 GMT

you could try those two:

rex field=_raw "RESPONSE_CODE:(?P<RespCode>\d+)"

rex field=_raw "errorCode\":\"(?P<ErrorCode>\d+)"

Edit: escaped quotes and used + thanks to richgalloway

Re: How do I write a regular expression to extract 2 fields from my sample data?

somesoni2 — Wed, 14 Sep 2016 15:48:37 GMT

Try this

index=nitro_prod_ecomm errorCode |rex "RESPONSE_CODE:(?<RespCode>\d+)" | rex "\"errorCode\":\"(?<ErrorCode>\d+)\"" | where RespCode = 400 AND ErrorCode = 1001 | stats count

Re: How do I write a regular expression to extract 2 fields from my sample data?

sundareshr — Wed, 14 Sep 2016 15:49:15 GMT

Try these two regex

... | rex "errorCode\"\:\"(?<err_code>\d+)\"" | rex "RESPONSE_CODE\:(?<resp_code>\d+)"

Re: How do I write a regular expression to extract 2 fields from my sample data?

richgalloway — Wed, 14 Sep 2016 15:51:22 GMT

The quotes with the regex will have to be escaped.
I prefer to use \d+ to avoid assumptions about the length of a number.