rex command

[saifdj]

How to fetch activity id using rex command

Log record:

DATA= {"note":"Succeeded | {\r\n \"service.url\": \"\",\r\n \"enable.debug\": false,\r\n \"permission.base.url\": \"\",\r\n \"userInfo.base.url\": \"\",\r\n \"storeId.base.url\": \"\",\r\n \"app.session.timeout\": 25\r\n},activityId: 64AB3318-4DA3-4D38-9800-5DABCC7EC263,","appVersion":"1.10"

I tried below query with no luck,

| rex field=DATA ",activityId: (?<ACTIVITY_ID_VALUE>.*)"

Trying to fetch value "64AB3318-4DA3-4D38-9800-5DABCC7EC263" and show in table

[PavelP]

Hello @saifdj

please double check you that you have an extracted field DATA.

If not you can use a general regex applied to whole _raw event (which is not so effizient as you indended):

rex "activityId: (?<a1>[\w\-]+)"

Please let me know how if it worked

[cpetterborg]

Slightly more generic (since it looks like a comma is the delimiter):

... | rex "activityId: (?<ACTIVITY_ID_VALUE>[^,]+)"