I'm trying to extract this field that has colon, backslash and quotes around it and its not yielding any result.
Field looks like this: [{\"errorCode\":9810,
This is what I tried:
index=main errorCode | rex field=_raw "\"errorCode\\\":(?<code>....)" | table code
This is giving empty result.
Would appreciate any hints or suggestions.
your log is JSON, try spath
This may help..
index=main errorCode | rex field=_raw "errorCode\\\\\":(?<code>\d+)" | table code
Hey Saravanan, do you know how to extract second occurrence of errorCode?
This query is extracting the first occurrence fine but I need to skip the first and retrieve the second occurrence.
Hi @ank15july96 ,
You can try spath as suggested by @to4kawa as it will extract all the fields json & xml.
Below may help to extract the second occurrence...
|rex field=_raw max_match=0 "errorCode\\\\\":(?<code>\d+)") | eval code=mvindex(code,1)
Please give me the entire log.
There is also a way to do spath.