Hi guys,
This is one example of my data:
Optional("{\"operationName\":\"createCart\",\"variables\":{\"customerId\":\"34234323\",\"operationalModel\":\"PICK_AND_COLLECT\",\"storeId\":\"596\"}}")
Optional("{\"operationName\":\"getOrdersByCustomer\",\"variables\":{\"pagination\":{\"currentPage\":1,\"pageSize\":100}}}")
Basically i want to retrieve all values such as: operationName\":\"createCart\"
As context, the field extraData.REQUEST_BODY should be a JSON, but due to a error code (can´t release now to prod), this became a malformed JSON, hence a simple string, so i'm trying to get all operationName values
This is my splunk query
index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | rex field='extraData.REQUEST_BODY' "(?<opName>operationName\\\"\:\\\"\w+\\\")" | table opName
i have verified the Regex, and i have removed single quotes from 'extraData.REQUEST_BODY', i have tried to change to double quotes, etc.
Could you please help me?
Thank you
After some research i found there is a tricky thing with slashes, it worked for me:
index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson
After some research i found there is a tricky thing with slashes, it worked for me:
index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson