Splunk Search

Extract Field with Backslash and Quotes

ank15july96
Engager

I'm trying to extract this field that has colon, backslash and quotes around it and its not yielding any result.

Field looks like this: [{\"errorCode\":9810,

This is what I tried:

index=main errorCode | rex field=_raw  "\"errorCode\\\":(?<code>....)" | table code

This is giving empty result.

Would appreciate any hints or suggestions.

Labels (4)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

your log is JSON, try spath

0 Karma

saravanan90
Contributor

This may help..

index=main errorCode | rex field=_raw "errorCode\\\\\":(?<code>\d+)" | table code

 

0 Karma

ank15july96
Engager

Hey Saravanan, do you know how to extract second occurrence of errorCode?
This query is extracting the first occurrence fine but I need to skip the first and retrieve the second occurrence.

0 Karma

saravanan90
Contributor

Hi @ank15july96 ,

You can try spath as suggested by @to4kawa as it will extract all the fields json & xml.

Below may help to extract the second occurrence...

|rex field=_raw max_match=0 "errorCode\\\\\":(?<code>\d+)")  | eval code=mvindex(code,1)

 

 

0 Karma

to4kawa
SplunkTrust
SplunkTrust

Please give me the entire log.
There is also a way to do spath.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!