Help with Rex field-extraction

[d00680245]

I'm having a difficult time extracting the value for reportId. I'm not sure how to find the digits to the right of "reportId":
The reportId value has a range between 5 to 9 digits. I basically want to find anything between "reportId": AND ,
I've tried Splunk Field-Extractor and many similar examples on answers, but just cannot seem to get anything working.

raw sample data:

2015-05-28 08:27:19,378 INFO com.test.test.reports.Generation.ReportImageServiceListener - message received: {"location":"1","area":1,"Symbol":" LT","Number":"12345","Ids":[1.0,2.0,6.0],"Category":"ALL","reportLevel":"FIELD_GROUP","reportDelivery":"EMAIL_BUNDLE","reportType":"FORM","reportLayout":"LANDSCAPE","Year":2015,"userId":50000,"reportId":0000001,"layers":["CLU_BOUNDARIES","TEST_CLU_BOUNDARIES","ASSOCIATED_LABELS","CLU_LABELS","ASSOCIATED_CLUS","ANNUAL_CLUS","TEST_ACRES_CLUS","POLYGONS","AERIAL_IMAGERY","COUNTIES","PLSS","ROADS","TOWNS","WATERWAYS"],"plantedReport":false,"CluLabelOne":"FSN","FieldLabelFour":"NONE","FieldDisplayOption":"ALL","CluLabelThree":"FIELD","CluLabelTwo":"TRACT","FieldLabelOne":"LABEL","FieldLabelTwo":"ACRES","CluLabelFour":"FIELD_ACRES","FieldColorOption":"CROP","CluLabelFive":"PLANTED_ACRES","FieldLabelThree":"NONE","FieldYieldOption":"CURRENT_USE","FieldLabelFive":"NONE"}

[Michael_Wilde]

You might consider making a bit more of a generic regex so you can use it with other fields. If you just tell splunk "after this stuff, grab anything thats inside the quotes.. or grab anything before this comma" you might use that regex on other fields too! Like this:

 | rex "reportId\"\:(?<reportId>[^,\"]+)"

Inside that regex, I'm looking for a single character list, but the ^ "caret" negates it, so it says "anything that is not a comma, or a quote".. and then we repeat that as many times as we can with the "+" plus sign. Make a slight change to the preceding characters and the field name and use the same internal regex, like this:

| rex "reportLayout\"\:\"(?<reportLayout>[^,\"]+)"

[richgalloway · Accepted solution]

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)

[d00680245]

Thank you! This works for me! I was using www.regexr.com and plugged your solution in there and doesn't seem to work, but I'll definitely try out regex101.com.

[richgalloway]

The biggest advantage (IMO) that regex101 has over regexr is support for the same regex syntax as Splunk.

[rsennett_splunk]

regexr.com was my first love... and then I discovered that regex101.com understands the named capturing groups where the former does not. it's also nice to be able to save and share your regex with a link.