Using rex to split raw field

[Janani_Krish]

I have raw field in the below format.

{"device":"device1","date":"2020-09-16T05:17:04.197Z","file_path":"CSIDL_PROFILE\\appdata","file_hash":"1bcdefgh12469"}

I wanted the content of file_path like "CSIDL_PROFILE\\appdata"[inclusing quotes]. I tried something like below,

sourcetype="file"|rex "{"device":"*","date":"*","file_path":(?<file>.*)"|table _raw,file

I am not good at rex queries. Please suggest me some ideas to take the values of file_path including quotes.

[thambisetty]

simple, value will be extracted to new field called "file_path"

| rex "file_path\":(?<file_path>[^\,]+)"

[gcusello]

Hi @Janani_Krish,

if you want to include also quotas, please, try this regex:

| rex "\"file_path\":(?<file_path>[^,]*),"

that you can test at https://regex101.com/r/IBotDY/1

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

This looks like json so spath may be an easier option

| spath file_path
| eval file_path="\""+file_path+"\""

Second line adds the quotes back in 

If you still want to use rex, try:

| rex "file_path\"\:(?<file_path>\"[^\"]+\")"