Dashboards & Visualizations

How to create a regex to capture 4 different values?

VijaySrrie
Builder

Hi All,

I need help with regex

{"CreationTime": "2022-06-28T01:55:52", "ExchangeMetaData": {"BCC": [], "CC": ["cat@gmail.com", "ant@gmail.com", "sat@gmail.com", "mat@gmail.com"]

Need to capture values under CC
4 different values to be captured under CC
I tried a regex which is capturing only the first value -->    \"CC\"\:\s\[\"?(?<exchangeCc>(\w?\@?\.?)+)

Else with a different regex it is capturing all 4 values as one single value ---> CC\"\:\s+\[(?<CC>[^\]]+)

Is it possible to capture it as  4 different values?

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

maybe not the most preferred version, but you could try this

| makeresults
| eval _raw = "{\"CreationTime\": \"2022-06-28T01:55:52\", \"ExchangeMetaData\": {\"BCC\": [], \"CC\": [\"cat@gmail.com\", \"ant@gmail.com\", \"sat@gmail.com\", \"mat@gmail.com\"]}}"
| rex "CC\"\:\s+\[(?<CC>[^\]]+)"
| rex max_match=0 field=CC "(?<cc>\w+@[^\"]+)+"
| fields - _time _raw

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

maybe not the most preferred version, but you could try this

| makeresults
| eval _raw = "{\"CreationTime\": \"2022-06-28T01:55:52\", \"ExchangeMetaData\": {\"BCC\": [], \"CC\": [\"cat@gmail.com\", \"ant@gmail.com\", \"sat@gmail.com\", \"mat@gmail.com\"]}}"
| rex "CC\"\:\s+\[(?<CC>[^\]]+)"
| rex max_match=0 field=CC "(?<cc>\w+@[^\"]+)+"
| fields - _time _raw

r. Ismo 

VijaySrrie
Builder

@isoutamo its working, can you please explain below line?

| rex max_match=0 field=CC "(?<cc>\w+@[^\"]+)+"
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You can use this https://regex101.com/r/juMbja/1 to understand this (and other) better.

Named Capture Group cc (?<cc>\w+@[^\"]+)

\w matches any word character (equivalent to [a-zA-Z0-9_])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)Named Capture Group cc (?<cc>\w+@[^\"]+)

\w matches any word character (equivalent to [a-zA-Z0-9_])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)

Match a single character not present in the list below [^\"]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)

Match a single character not present in the list below [^\"]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...