Splunk Search

Extracting field with quotes doesnt seem to work.

balash1979
Path Finder

Here is the message in splunk and I am trying to extract customer and channel

{"line":"2020-04-03T12:24:54.589Z LCS {\"customer\":5,\"channel\":\"sqs\",\"notificationId\":213546} 

When I run something like this

index=docker  "Exception" | rex "CustomerID: (?<customer>\S+)," |  rex "channelName\\\\\":\\\\\"(?<channel>\w+)"  | stats count(notificationId) by CustomerID 

I am able to see the CustomerID extracted

but when I do

index=docker  "Exception" | rex "CustomerID: (?<customer>\S+)," |  rex "channelName\\\\\":\\\\\"(?<channel>\w+)"  | stats count(notificationId) by CustomerID, channelName

It is not displaying any results which tells me I am not extracting the channelName correctly. How can I fix this ?

0 Karma
1 Solution

woodcock
Esteemed Legend

Your data has channel but your RegEx has channelName so try this:

... | rex "channel\\\\\":\\\\\"(?<channel>\w+)"

View solution in original post

woodcock
Esteemed Legend

Your data has channel but your RegEx has channelName so try this:

... | rex "channel\\\\\":\\\\\"(?<channel>\w+)"

jpolvino
Builder

Nobody likes backslashes!

| makeresults
| eval _raw="{\"line\":\"2020-04-03T12:24:54.589Z LCS {\\\"customer\\\":5,\\\"channel\\\":\\\"sqs\\\",\\\"notificationId\\\":213546}"
| rex "customer\\\\\":(?<customer>[^,]+),\\\\\"channel\\\\\":\\\\\"(?<channel>[^\\\]+)\\\\\""
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Neither of your regular expressions match the example data. There is no "CustomerID:" string and no "channelName" string. Please verify the data so we can help you.

Escaping of '\' is unintuitive in rex. Experiment with the number of \\ used to get the desired results.

---
If this reply helps you, Karma would be appreciated.
0 Karma

balash1979
Path Finder

Never mind. I was looking at the wrong values. Thanks for pointing it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...