Regex not working

[Deprasad]

Trying to Pick domainType and domainName from below log using the below regex:

It works in regex101 but not in Splunk, it gives a blank column.

domainName - rex"(?:domainName\\\"\:\\\")(?<domainName>([a-zA-Z0-9-\.]+))" 
domainType - rex"(?:domainType\\\"\:\\\")(?<domainType>\w)"

"payload":"{\"domainType\":\"L\",\"modifiedBy\":\"\",\"relayHost\":\"\",\"rewriteDomain\":\"\",\"wildcardAccount\":\"\",\"domainName\":\"xxx.yyyyy.com\"}"},"encoding":null,"contentType":"application/json","responseCode":null} 

[saravanan90]

Below may help you..

|makeresults | eval _raw="\"payload\":\"{\\\"domainType\\\":\\\"L\\\",\\\"modifiedBy\\\":\\\"\\\",\\\"relayHost\\\":\\\"\\\",\\\"rewriteDomain\\\":\\\"\\\",\\\"wildcardAccount\\\":\\\"\\\",\\\"domainName\\\":\\\"xxx.yyyyy.com\\\"}\"},\"encoding\":null,\"contentType\":\"application/json\",\"responseCode\":null}\"" | rex field=_raw "domainType\\\\\":\\\\\"(?<domainType>[^\\\\\"]+).+domainName\\\\\":\\\\\"(?<domainname>[^\\\\\"]+)"

-------------------------------------------------------------------------------------

An upvote would be appreciated if the above reply is useful to you.

[ITWhisperer · Accepted solution]

Rex in splunk requires more escaping for backslashes than regex101

| makeresults | eval _raw="\"payload\":\"{\\\"domainType\\\":\\\"L\\\",\\\"modifiedBy\\\":\\\"\\\",\\\"relayHost\\\":\\\"\\\",\\\"rewriteDomain\\\":\\\"\\\",\\\"wildcardAccount\\\":\\\"\\\",\\\"domainName\\\":\\\"xxx.yyyyy.com\\\"}\"},\"encoding\":null,\"contentType\":\"application/json\",\"responseCode\":null} "
| rex "(?:domainName\\\\\"\:\\\\\")(?<domainName>([a-zA-Z0-9-\.]+))"
| rex "(?:domainType\\\\\"\:\\\\\")(?<domainType>\w)"

[Deprasad]

Thanks!! that's worked. 🙂

[gcusello]

Hi @Deprasad,

please try this:

| rex "domainType\":\"(?<domainType>[^\"]*).*domainName\":\"(?<domainName>[^\"]*)"

that you can test at https://regex101.com/r/4QfKNj/1

Ciao.

Giuseppe

[Deprasad]

Thanks!! The payload you used in the regex101 is not same as the provided.
Though it worked in Regex101, still faced the same issue with Splunk. Tried the solution suggested by @ITWhisperer and it worked.