Getting empty values when using rex to get a string

[Rodrigo_Larios]

Hi guys, 

This is one example of my data:

Optional("{\"operationName\":\"createCart\",\"variables\":{\"customerId\":\"34234323\",\"operationalModel\":\"PICK_AND_COLLECT\",\"storeId\":\"596\"}}")

Optional("{\"operationName\":\"getOrdersByCustomer\",\"variables\":{\"pagination\":{\"currentPage\":1,\"pageSize\":100}}}")

Basically i want to retrieve all values such as: operationName\":\"createCart\"

As context, the field extraData.REQUEST_BODY should be a JSON, but due to a error code (can´t release now to prod), this became a malformed JSON, hence a simple string, so i'm trying to get all operationName values

This is my splunk query

index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | rex field='extraData.REQUEST_BODY' "(?<opName>operationName\\\"\:\\\"\w+\\\")" | table opName

i have verified the Regex, and i have removed single quotes from 'extraData.REQUEST_BODY', i have tried to change to double quotes, etc.

Could you please help me?

Thank you

[Rodrigo_Larios · Accepted solution]

After some research i found there is a tricky thing with slashes, it worked for me:

index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=***  | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson