topic Re: Regex Help in Splunk Search

Regex Help

brajaram — Mon, 08 Jan 2018 23:28:56 GMT

Hi,

Struggling yet again with another regex. The sample string looks like the following:

.........,"errorCode":"500113"}, .......

As part of a whole JSON response.

If I take that JSON and put it into regex101, I can use the following rex to correctly capture the code

"errorCode\":(.*?)},

However, I'm not sure how to turn that into a rex command to parse out the field. If I simply replace the .* with ?<> with a field name inside the brackets it errors out, and in fact I can't ever get it to not throw an error.

How do I turn an accurate regular expression(at least from my testing using online regular expression tools) into a rex command to capture a field in Splunk?

Re: Regex Help

micahkemp — Mon, 08 Jan 2018 23:31:53 GMT

Don't replace .* with ?<fieldName>. You add ?<fieldName> after your (, like:

"errorCode\":(?<errorCode>.*?)},

Full rex (alteration to exclude double quotes from the extracted value):

| rex "\"errorCode\":\"(?<errorCode>.*?)\"},"

Probably better version, which specifies that errorCode can't contain ":

| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\"},"

Re: Regex Help

brajaram — Mon, 08 Jan 2018 23:41:43 GMT

Ahh, thanks for the explanation! Works perfectly. Appreciate the help!

Re: Regex Help

horsefez — Tue, 09 Jan 2018 12:15:23 GMT

The feeling you have when you are too late to a regex question :S