rex need help

[bhaskar5428]

 message: Send async response via rest [url=https://prd.ase1.dbktp-feedloader.prd.gcp.db.com/callbackservice/book, asyncResp={"transactionItems":[{"itemId":"KTPACC1_20240717000001633206_01","status":"FAILED","accountIdentification":{"gtbCashAccount":{"branchCode":"788","accountNumber":"0191395050","currencyCode":"USD"}}},{"itemId":"KTPACC1_20240717000001633206_02","status":"FAILED","accountIdentification":{"gtbCashAccount":{"branchCode":"788","accountNumber":"0000195054","currencyCode":"USD"}}}],"orderStatusResponse":{"orderStatus":"ORDER_FAILURE","orderId":"KTPACC1_20240717000001633206"},"error":{"errorCode":"SEP013","errorDescription":"Cannot find IDMS-0788 account by accNumber: 0000195054"}}]

==================================================================================

am using below query but its not giving me output , any idea 
index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE
| fields message
| rex field=message \"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\"
| dedup errorCode
| table errorCode
=====================================================================

However syntax showing correct on https://regex101.com/r/XkBntG/1 

[PickleRick]

Adding to @gcusello 's answer.

A quote is not in itself a special character within a regex so within the regex itself it doesn't have to be escaped - on regex101 you could just do

 "error":\{"errorCode":"(?<errorCode>[^"]+)"

(In this case you could also get away with not escaping the opening brace but it doesn't hurt and prevents accidental not-escaping when needed).

But as you're putting the regex in a string as part of the command - then you need to escape your quotes as part of the string so the strings are not interpreted as the end of string. That's why you end up with (notice double backslash before opening brace  - you also need to escape the backslash if you want it to be literally included in the string)

"\"error\":\\{\"errorCode\":\"(?<errorCode>[^\"]+)\""

[gcusello · Accepted solution]

Hi @bhaskar5428 ,

yes the regex is correct, but you need to put a quote before and after the regex in the rex command:

index = app_events_sdda_core_de_prod source="/home/sdda/apps/logs/sep-app/app-json.log" level=TRACE
| fields message
| rex field=message "\"error\":\{\"errorCode\":\"(?<errorCode>[^\"]+)\""
| dedup errorCode
| table errorCode

otherwise the rex command gives an error.

ciao.

Giuseppe

[gcusello]

Hi @bhaskar5428 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉