All Apps and Add-ons

Using rex to split raw field

Janani_Krish
Path Finder

I have raw field in the below format.

{"device":"device1","date":"2020-09-16T05:17:04.197Z","file_path":"CSIDL_PROFILE\\appdata","file_hash":"1bcdefgh12469"}

I wanted the content of file_path like "CSIDL_PROFILE\\appdata"[inclusing quotes]. I tried something like below,

sourcetype="file"|rex "{"device":"*","date":"*","file_path":(?<file>.*)"|table _raw,file

I am not good at rex queries. Please suggest me some ideas to take the values of file_path including quotes.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This looks like json so spath may be an easier option

 

| spath file_path
| eval file_path="\""+file_path+"\""

 

Second line adds the quotes back in 

If you still want to use rex, try:

| rex "file_path\"\:(?<file_path>\"[^\"]+\")"

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

simple, value will be extracted to new field called "file_path"

 

| rex "file_path\":(?<file_path>[^\,]+)"

 

————————————
If this helps, give a like below.

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

if you want to include also quotas, please, try this regex:

| rex "\"file_path\":(?<file_path>[^,]*),"

that you can test at https://regex101.com/r/IBotDY/1

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

This looks like json so spath may be an easier option

 

| spath file_path
| eval file_path="\""+file_path+"\""

 

Second line adds the quotes back in 

If you still want to use rex, try:

| rex "file_path\"\:(?<file_path>\"[^\"]+\")"
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...