How to search a string ?

[ashukp]

Request={"headers":{"zip":"500000"}},"location":"HYD","info":[{"phoneNumber":"******6467","test":[{"id":"1234"}]}],"testing123":{"tenure":1234,"stringvalue":"A"}}}

How can search for "stringvalue":"A"?

I tried | makemv tokenizer="([^,]+)," Params | mvexpand line
| rex field=Params "(?<key>[^{'stringvalue'':']+) : (?<value>[A]+)" It did not work.

[gcusello]

Hi @ashukp,

do you want to search or to extract field?

if you want to search you can use the regex command:

| makeresults
| eval _raw="Request\=\{\"headers\":\{\"zip\":\"500000\"\}\},\"location\":\"HYD\",\"info\":\[\{\"phoneNumber\":\"******6467\",\"test\":\[\{\"id\":\"1234\"\}\]\}\],\"testing123\":\{\"tenure\":1234,\"stringvalue\":\"A\"\}\}\}"
| regex  "\"stringvalue\":\"[^\"]+\""

if instead you want to extarct the value after "stringvalue", you have to use the rex command:

| makeresults
| eval _raw="Request\=\{\"headers\":\{\"zip\":\"500000\"\}\},\"location\":\"HYD\",\"info\":\[\{\"phoneNumber\":\"******6467\",\"test\":\[\{\"id\":\"1234\"\}\]\}\],\"testing123\":\{\"tenure\":1234,\"stringvalue\":\"A\"\}\}\}"
| rex  "\"stringvalue\":\"(?<stringvalue>[^\"]+)\""

Ciao.

Giuseppe