Splunk Search

How can I extract this field using REGEX (rex)?

New Member

Hi,

I have the below raw, I would like to extract MaximumBatchQuantity value, which is 20. Can someone help me with REGEX, please?

{"bdy":{"msg":"HttpRequest","addInfo":[{"key":"Url","value":"https://isp0064x.st.ad.XXXXX.com/XXXXXOmniFulfillmentServerApp/api/Assignment/Auto/"},{"key":"Content","value":"{\"Filters\":[],\"**MaximumBatchQuantity**\":**20**,\"AllowedSLAMilliSeconds\":4500,\"AssociateFirstName\":\"Aliona\",\"AssociateId\":\"2795969\",\"AssociateLastName\":\"Cieniawa\",\"Header\":{\"ApiVersion\":null,\"AppVersion\":\"18.3.0.15617\",\"JsonWebToken\":null,\"MessageId\":\"de959d4f-6a7d-4c0c-98d3-1143064b4300\"},\"IsOffline\":false,\"SLARequestKey\":\"AutoBatch\",\"StoreNumber\":\"0064\"}"},{"key":"CorrelationId","value":""},{"key":"MessageId","value":"3a04038d-64e2-493c-b489-90a922de1980"}]},"hdr":{"level":"Verbose","timestamp":"2018-06-04T21:03:19.6347626Z","fxsrc":"LogRequestInfo","lineNum":710,"userId":"2795969","loc":"Store","locId":"0064","ip":"10.224.255.15","hostName":"K-W10ME-7463352","macaddress":"00-16-XX-16-A6-FA","eventid":0,"appVersion":"18.3.0.15617","appName":"OmniFulfillment","deviceModel":"XX500","osVersion":"10.0.14393.2007","firmwareVersion":"1049.7.18039.0","networkSignalStrength":"4","isConnected":"True"},"ver":"0.1"}
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Assuming those asterisk in the field name and value of MaximumBatchQuantity is added by you trying to highlight/bold it, give following regex a try

MaximumBatchQuantity[^:]+:(?<MaximumBatchQuantity>[^,]+)

See it working with your sample data

https://regex101.com/r/URJNJH/1

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I heard you liked JSON, so I put some JSON in your JSON? Eww.

... | rex "\\\"MaximumBatchQuantity\\\"\s*:\s*\"?(?<MaximumBatchQuantity>\d+)"
0 Karma

New Member

Thanks for the response, this is giving me null value

0 Karma

SplunkTrust
SplunkTrust

Assuming those asterisk in the field name and value of MaximumBatchQuantity is added by you trying to highlight/bold it, give following regex a try

MaximumBatchQuantity[^:]+:(?<MaximumBatchQuantity>[^,]+)

See it working with your sample data

https://regex101.com/r/URJNJH/1

View solution in original post

0 Karma

New Member

I used this way

| rex field=_raw MaximumBatchQuantity[^:]+:(?[^,]+)

0 Karma

SplunkTrust
SplunkTrust

put quotes around the expression

0 Karma

New Member

Thanks for the response, I'm getting below error,

Error in 'SearchParser': Missing a search command before '^'. Error at position '522' of search query 'search index=kohlsprodstores_servers sourcetype=...{snipped} {errorcontext = hQuantity[^:]+:(?

0 Karma

SplunkTrust
SplunkTrust

What's the search you're using? I just gave you the regex portion, you'd need to add other search parts.

0 Karma