Splunk Enterprise

Help with rex field extraction?

Allampally
Path Finder

Hi All,

I have two events as below. In both the events, data format is different. We can observe extra "/" from few events. How to capture the logEntryType from both of them by using rex command ?

,\"logEntryType\":\"SUMMARY\",
,"logEntryType":"Detail",

Field Name should be "logEntryType" and values should be "SUMMARY" and "Detail".

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON, the first string being embedded JSON (within another JSON field?) - have you tried using spath to extract the fields (It might need 2 spath's to extract the embedded JSON correctly)?

If you don't want to use spath (for whatever reason), the use of rex can get a little messy

| rex max_match=0 "\\\\?\"logEntryType\\\\?\":\\\\?\"(?<logEntryType>[^\"\\\\]+)"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON, the first string being embedded JSON (within another JSON field?) - have you tried using spath to extract the fields (It might need 2 spath's to extract the embedded JSON correctly)?

If you don't want to use spath (for whatever reason), the use of rex can get a little messy

| rex max_match=0 "\\\\?\"logEntryType\\\\?\":\\\\?\"(?<logEntryType>[^\"\\\\]+)"
0 Karma

Allampally
Path Finder

I tried using SPATH but didn't work for me. Could you please help me to write two spaths to extract embedded json requests ? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For that I would need an example of your events - please share anonymised version in a code block </> so that formatting is preserved.

0 Karma

Allampally
Path Finder

I can't post even sample data here. Is there any link or tutorial to use spath for json requests ? 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...