Getting Data In
Highlighted

How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi, I wonder whether someone could help me please.

I'm trying to create a Splunk regular expression to extract the postcode from the sample as shown below.

{"line1":"1 THE STREET","line2":"TOWN","line3":"CITY","line4":null,"postcode":"AB1 1AB","country":"GREAT BRITAIN","startDate":944697600000,"type":"Residential"}

I'm using Regex101 and in this I can create the following which extracts the data:

\"postcode\"\:\"(?[^\.]{0,7})\"

However, when I run this in Splunk, it doesn't extract the data.

I think it may have something to do with the space between the two elements of the postcode, but could someone please look at this and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

I am assuming from your sample data that you are trying to extract AB11AB from "postcode":"AB11AB" hence I have written regex to capture POSTCODE as string between "postcode":"POSTCODE "

your query to return events
| rex field=_raw "\"postcode\"\:\"(?<myPostcode>[^\"]+)\""
| table myPostcode

See regex in action here

In case you want to go json way, try this:

your query to return json events
 | spath output=myPostcode path=postcode
 | table postcode, myPostcode

View solution in original post

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi thank you for coming back to me with this, but it doesn't work. I've looked at our regex101 example and it doesn't include the space between the two elements of the postcode. I think that may be the issue.

Many thanks and kind regards

Chris

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Did you see the link I posted...Regex is to capture everything between "postcode":" and ending ". So even if there are spaces in between it will capture. Can you please paste the sample postcode, an actual event containing this postcode.

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi @gokadroid, thank you for coming back to me and my sincere apologies because my sample didn't show a space between two elements of the postcode. I've now changed this.

So this is where I have the problem, both solutions don't extract the postcode data.

Your solution works great in regex101 for postcodes with and without a space, but doesn't in Splunk.

Many thanks and kind regards

Chris

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Where in Splunk are you using it? Are you writing it like the SPL query I have written?

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi @gokadroid, thank you for this.

My query line for this is as follows:

| rex field=detail.responseMessage ""

I then use the regex name, in this case to display in a table.

Kind Regards

Chris

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Can you try to use the field=_raw rather than field=detail.responseMessage?

If your data is json then try to use spath which can also assist like this:

your query to return json events
| spath output=myPostcode path=postcode
| table postcode, myPostcode
0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi, this is very strange.

Because I've found that the field is extracting the data as an "interesting filed", but when I try to use this in a table, the column returns blank values.

Kind Regards

Chris

0 Karma
Highlighted

Re: How to edit my regular expression to include a space in order for Splunk to extract data?

Motivator

Hi @gokadroid.

I've cracked it. I discovered because the field was missing from a "stats values) row further down in the query, it wasn't appearing in the table.

My sincere apologies for messing you around and many thanks for your help.

Kind Regards

Chris