All Apps and Add-ons

what regex command i can use in order to create a field in splunk

s0m073r
Engager

I have a data which splunk shows, but i dont see a field for what i wanted

"ag-somethin-id":["97234d506-E0ASD-4XXX-AXX0-ASD77757"]

I need to to create a field with ag-somethin-id which should actually give me the all the values under those events and it should show something like:

97234d506-E0ASD-4XXX-AXX0-ASD77757 under this field ag-somethin-id

Till now I have tried using the below, but its not correct:

rex "ag-somethin-id[\\":](?[^\[":"])"

Please help in fixing this

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This worked for me in regex101.com using your sample data.

rex "ag-somethin-id\":\[\"(?<somethin>[^\"]+)"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This worked for me in regex101.com using your sample data.

rex "ag-somethin-id\":\[\"(?<somethin>[^\"]+)"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post