Splunk Search

Help with rex- Unbalanced quotes when there are \ and " in string

jhcbazinga95
Loves-to-Learn Everything

Hey community,

Can someone help me out with a rex related question! Many many thanks!

I am trying to rex the V1 out of a sample string and I have tried  catalogVersion\\":\\"(?P<catalogVersion>[^ ]+)\\",  

In regex101, it is working, However, I am getting a Unbalanced quotes error in Splunk.

sample string

\"transferDisconnectReasons\":null,\"catalogVersion\":\"V1\",\"accountCustomerDetails\"

jhcbazinga95_0-1666906665894.png

 

jhcbazinga95_1-1666906692423.png

 

Cheers!

Labels (1)
0 Karma

jotne
Builder

In Splunk regex, if escaping does not work, add more \ until id does work :winking_face:

 

johnhuang
Motivator

Yea, this is a pain.

1. You can double escape each backslash and escape each quotes.  You'll end up with something like this:

| rex field=_raw "catalogVersion\\\\\":\\\\\"(?P<catalogVersion>[^ ]+)\\\\\","


2. Or you can replace all the backslash in the data which makes it easier to parse:

| rex field=_raw mode=sed "s/\\\//g"
| rex field=_raw "catalogVersion\":\"(?P<catalogVersion>[^\"]*)"

 

3. Or you can substitute value of \ and " with its unicode hex equivalent

| rex field=_raw "catalogVersion\x5c\x22:\x5c\x22(?P<catalogVersion>[^ ]+)\x5c\x22,"

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...