Field Extraction not working, need usable rex expression

[nkavouris]

I have a search that yields

"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257"

I am trying to extract the bold value associated with fuel, the value can be any number 0-1000 Using the field extractor I have gotten an unusable rex result:  

rex message="^\{"\w+":\d+,"\w+_\w+":"[a-f0-9]+","\w+":"\w+_\w+","\w+_\w+":"\w+","\w+_\w+":"\w+","\w+":\{"\w+":"\w+","\w+":"\w+","\w+":\d+\.\d+,"\w+":\-\d+\.\d+,"\w+":"\w+"\},"\w+_\w+":"\w+","\w+":"\w+::\w+_\w+_\w+:\s+\w+:\s+\d+,\s+\w+:\s+\d+,\s+\w+_\w+:\s+\d+,\s+\w+:\s+\w+,\s+\w+:\s+(?P<fuel_level>\d+)"

When trying to search with this, the next command does not work and my result yields: Invalid search command 'a'

Can someone give me usable rex to get the highlighted number in a field titled 'fuel_level'

[yuanliu]

Please illustrate full message.  The look of the fragment suggest your source is actually JSON, something like

{"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"}

Is this correct?  Using regex directly on structured data is strongly discouraged as any regex is doomed to be fragile.

If the JSON is raw event, Splunk would have already extracted a field called "message".  Start from this field instead.  This field also is structured as KV pairs.  Use kv aka extract instead of regex.

| rename _raw as temp, message as _raw
| kv kvdelim=": " pairdelim=","
| rename _raw as message, temp as _raw
| fields fuel

Your sample data would have given

fuel	_raw	_time
0	{"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"}	2024-07-17 09:06:35

Here is an emulation for you to play with and compare with real data

| makeresults
| eval _raw = "{\"message\":\"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257\", \"foo\":\"bar\"}"
| spath
``` data emulation above ```