Splunk Search

Help with Rex field-extraction

Engager

I'm having a difficult time extracting the value for reportId. I'm not sure how to find the digits to the right of "reportId":
The reportId value has a range between 5 to 9 digits. I basically want to find anything between "reportId": AND ,
I've tried Splunk Field-Extractor and many similar examples on answers, but just cannot seem to get anything working.

raw sample data:

2015-05-28 08:27:19,378 INFO  com.rainhail.rhigis.reports.imageGeneration.ReportImageServiceListener - message received:
{"division":"2","state":12,"policySymbol":" MP","policyNumber":"713430","yieldIds":[1.0,2.0,6.0],"cluCategory":"ALL","reportLevel":"FIELD_GROUP","reportDelivery":"EMAIL_BUNDLE","reportType":"ACREAGE_REPORTING_FORM","reportLayout":"LANDSCAPE","cropYear":2015,"userId":50000,"reportId":15326067,"layers":["CLU_BOUNDARIES","RH_CLU_BOUNDARIES","ASSOCIATED_LABELS","CLU_LABELS","ASSOCIATED_CLUS","ANNUAL_CLUS","RHIGIS_ACRES_CLUS","POLYGONS","AERIAL_IMAGERY","COUNTIES","PLSS","ROADS","TOWNS","WATERWAYS"],"plantedReport":false,"CluLabelOne":"FSN","FieldLabelFour":"NONE","FieldDisplayOption":"ALL","CluLabelThree":"FIELD","CluLabelTwo":"TRACT","FieldLabelOne":"LABEL","FieldLabelTwo":"ACRES","CluLabelFour":"FIELD_ACRES","FieldColorOption":"CROP","CluLabelFive":"PLANTED_ACRES","FieldLabelThree":"NONE","FieldYieldOption":"CURRENT_USE","FieldLabelFive":"NONE"}
1 Solution

SplunkTrust
SplunkTrust

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Splunk Employee
Splunk Employee

You might consider making a bit more of a generic regex so you can use it with other fields. If you just tell splunk "after this stuff, grab anything thats inside the quotes.. or grab anything before this comma" you might use that regex on other fields too! Like this:

 | rex "reportId\"\:(?<reportId>[^,\"]+)"

Inside that regex, I'm looking for a single character list, but the ^ "caret" negates it, so it says "anything that is not a comma, or a quote".. and then we repeat that as many times as we can with the "+" plus sign. Make a slight change to the preceding characters and the field name and use the same internal regex, like this:

| rex "reportLayout\"\:\"(?<reportLayout>[^,\"]+)"
0 Karma

SplunkTrust
SplunkTrust

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Engager

Thank you! This works for me! I was using www.regexr.com and plugged your solution in there and doesn't seem to work, but I'll definitely try out regex101.com.

0 Karma

SplunkTrust
SplunkTrust

The biggest advantage (IMO) that regex101 has over regexr is support for the same regex syntax as Splunk.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Splunk Employee
Splunk Employee

regexr.com was my first love... and then I discovered that regex101.com understands the named capturing groups where the former does not. it's also nice to be able to save and share your regex with a link.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!