Splunk Search

Help with | rex command to extract a field?

adhwihhiahwd
Engager

hello everyone,

 

my event data looks like this

 

 

 

{\"status\":1,\"httpStatus\":200,\"event\":\"getBooks\"}

 

 

 

My goal is to extract httpStatus as a field so I can filter events by their codes(e.g 200, 400 ..)

 

I learned that we need to escape backslashes and double quotes but the command below didn't work

 

 

 

| rex "httpStatus\\\":(?<http_status>\d+)"

 

 

 

What did i do incorrectly here?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

hi @adhwihhiahwd,

I suppose that yu tested yur regex in regex101.com and it runs but it doesn't run in Splunk,

so, try using four back slashes

| rex "httpStatus\\\\":(?<http_status>\d+)"

Ciao.

Giuseppe

View solution in original post

adhwihhiahwd
Engager

wow thanks!

4 back slashes worked...

| rex "httpStatus\\\\\":(?<http_status>\d+)"

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adhwihhiahwd,

Splunk mysteries!!!

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @adhwihhiahwd,

I suppose that yu tested yur regex in regex101.com and it runs but it doesn't run in Splunk,

so, try using four back slashes

| rex "httpStatus\\\\":(?<http_status>\d+)"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...