how to capture 2 slightly different pattern of strings through regex and make it one field

[ms208a]

Hello All ,
i wanted to capture the numeric values for below strings ctn.
CTN captured into 2 different formats.
First "ctn": "2148504794" - it has space between ":" and numeric values
Second ctn":"2148504794" - it doesn't have space between ":" and numeric values
like
"ctnId":279,"ctn":"2148504794",
processDMaaPMessage {"device": [{"ctn": "2148504794","status": "Restored"}]}}

i am using this rex
rex "ctn\"[:|: ] \"(?\d+)\","

but it seems it didn't work

please suggest a fix

[mayurr98]

Try this run anywhere search

| makeresults 
| eval data="\"ctn\": \"2148504794\"" 
| append 
    [| makeresults 
    | eval data="ctn\":\"2148504794\""] 
| rex field=data "ctn\":(|\s+)\"(?<ctn>[^\"]+)"

In your environment you should try,

<your base search>| rex field=_raw "ctn\":(|\s+)\"(?<ctn>[^\"]+)"

let me know if this helps!

[xpac]

Also, you might want to start using a service like regex101.com. It would've shown you that your regex has invalid syntax. 🙂

[ms208a]

Thanks Mayur, it works 🙂

i am trying to capture below reasonMessage also, but it capture
the colon with space only like "reasonMessage": "Uplift transaction failed due to SWC system error"}]}}*

i wanted to capture below strings as well.
"reasonMessage": "Uplift transaction failed due to SWC system error"}]}}

Thanks alot for your time and inputs.

[mayurr98]

Try this regex \"reasonMessage\"\:\s\"(?<reasonMessage>[^\"]+)

[ms208a]

You rocks Mayur. Thanks again

[niketn]

@ms208a, if your issue is resolved, please accept the answer to mark this question as answered and help others facing similar issue in future.

Do up vote the comment/s that helped 🙂