Splunk Search

Help me with Rex in search query

sravankaripe
Communicator

"sessionID":"123456567"
"sessionID":"ABCnsh8ah"

Please help me with Rex to pick
123456567
ABCnsh8ah

from above _raw event

0 Karma
1 Solution

koshyk
Super Champion

Please try

<raw_search> | rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

Full example with sample data

|makeresults | eval _raw="\"sessionID\":\"123456567\""|  rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

View solution in original post

0 Karma

hhGA
Communicator

Hi,

Give this a shot:

rex field=_raw> "\"sessionID\":\"(?<field>\S+)\""
0 Karma

adayton20
Contributor

Try this:

| rex field=_raw "sessionID\"\:\"(<sessionID>.[^\"]*)"
0 Karma

koshyk
Super Champion

Please try

<raw_search> | rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

Full example with sample data

|makeresults | eval _raw="\"sessionID\":\"123456567\""|  rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.