Splunk Search
Highlighted

Help me with Rex in search query

Path Finder

"sessionID":"123456567"
"sessionID":"ABCnsh8ah"

Please help me with Rex to pick
123456567
ABCnsh8ah

from above _raw event

0 Karma
Highlighted

Re: Help me with Rex in search query

Super Champion

Please try

<raw_search> | rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

Full example with sample data

|makeresults | eval _raw="\"sessionID\":\"123456567\""|  rex  "sessionID\":\"(?<mysessionID>[\d\w]+)\""| table mysessionID

View solution in original post

0 Karma
Highlighted

Re: Help me with Rex in search query

Contributor

Try this:

| rex field=_raw "sessionID\"\:\"(<sessionID>.[^\"]*)"
0 Karma
Highlighted

Re: Help me with Rex in search query

Communicator

Hi,

Give this a shot:

rex field=_raw> "\"sessionID\":\"(?<field>\S+)\""
0 Karma