Extract a field using rex

davidda — Tue, 25 Jul 2017 07:39:53 GMT

Hi,

I want to create a new field named "RequestId" from the data after "channelRequestId:" field using regex.
This is the related part of my log (I've bold the the associated values i would like to extract):

parameterValue={"executingDetails":{"executingxxxNumber":xx,"executingxxxxNumber":xxx},"requestorData":{"requestorIDs":{"serviceProductID":9,
"channelRequestId":"12345678-1234-xxxx-xxxx-abcdeffxxxx","variousChannelTypeCode":9},"requestData":{"referenceNumber":000000,"customerRequestTimestamp":"2017-07-24 14:37:39"}},"xxxxData":{"xxxxxxNumberxxxx":"xxx","xxxToken":"9dc2b23f-ea4a-4632-8b57-f37eaebab64c"},"debitTransactionData":{"requestAmount":1210.0,"currencyTypeCode":1}}

I've tried the following regex but it doesn't work properly,
| rex mode=sed field=parameterValue "s/^(.?(channelRequestId)[^$])$//g"

Thanks!

Re: Extract a field using rex

gcusello — Tue, 25 Jul 2017 07:57:18 GMT

Hi davidda,
try something like this

\"channelRequestId\":\"(?<channelRequestId>[^\"]*)

| rex field=parameterValue "\"channelRequestId\":\"(?<channelRequestId>[^\"]*)"

You can test it at https://regex101.com/r/BM6c6E/1
Bye.
Giuseppe

Re: Extract a field using rex

davidda — Tue, 25 Jul 2017 08:03:47 GMT

Thank you, the second option works perfectly!

topic Extract a field using rex in Splunk Search

Extract a field using rex

Re: Extract a field using rex

Re: Extract a field using rex