Splunk Search

Getting empty values when using rex to get a string

Rodrigo_Larios
Explorer

Hi guys, 

This is one example of my data:

Optional("{\"operationName\":\"createCart\",\"variables\":{\"customerId\":\"34234323\",\"operationalModel\":\"PICK_AND_COLLECT\",\"storeId\":\"596\"}}")

Optional("{\"operationName\":\"getOrdersByCustomer\",\"variables\":{\"pagination\":{\"currentPage\":1,\"pageSize\":100}}}")

Basically i want to retrieve all values such as: operationName\":\"createCart\"

As context, the field extraData.REQUEST_BODY should be a JSON, but due to a error code (can´t release now to prod), this became a malformed JSON, hence a simple string, so i'm trying to get all operationName values

This is my splunk query

index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=*** | rex field='extraData.REQUEST_BODY' "(?<opName>operationName\\\"\:\\\"\w+\\\")" | table opName

i have verified the Regex, and i have removed single quotes from 'extraData.REQUEST_BODY', i have tried to change to double quotes, etc.

Could you please help me?

Thank you

 

Labels (1)
0 Karma
1 Solution

Rodrigo_Larios
Explorer

After some research i found there is a tricky thing with slashes, it worked for me:

index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=***  | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson

View solution in original post

0 Karma

Rodrigo_Larios
Explorer

After some research i found there is a tricky thing with slashes, it worked for me:

index="mint" apiKey=*** | search event_name=*** extraData.ENDPOINT=***  | eval cleanedJson=substr('extraData.REQUEST_BODY',11) | eval slashCleanJson = replace(cleanedJson,"\\\\","") | rex field=slashCleanJson "(?\"operationName\"\:\"\w+\")" | table opName,slashCleanJson,cleanedJson

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...