Splunk Search

Create new Field Extraction regex expression via REST API Java SDK

misteryuku
Communicator

I have created a new field extraction on props.conf via Splunk REST API

I have a raw message that looks like this.
field1=Happy,field2=Sad,field3=Angry, messenger : my message, keyer : jun

i put in the regex expression to extract jun from the raw message into a search time field called hhj.

the regex that i generated from the IFX was this : (?!)keyer : (P.+)

Using the Java SDK to create the new field extraction via Splunk REST API
RequestMessage reqMsg = new RequestMessage();
reqMsg.setMethod("post");
reqMsg.setContent("name=hhj&stanza=source::sample&type=EXTRACT&\value=(?i) messenger : (?P.+)\"");
authService.send("/servicesNS/admin/search/data/props/extractions",reqMsg);

When i viewed the props.conf file, it gave me

[source::sample]
EXTRACT-hhj = (?i) keyer : (?P.)

The plus + sign inside the regex that i set through the rest endpoint was missing.
How do i make sure that the plus sign appears whenever i create the search time field extraction via the REST endpoint using Java for the above regex that i set.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You need to URL-encode any form data that you post. You can use the java method java.net.URLEncoder.encode() for this.

Incidentally, you're not really using the Splunk Java SDK here. You are actually just working directly with the REST API from Java here. That's fine, as the REST API is fully supported. But the SDK in general should not require you to be getting into the details of making HTTP/REST calls work.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...