How do I extract a field from my raw data using rex command?

[tanvi1g]

Hi,

Can someone able to help me please.

I'm very new to using Splunk and most certainly to the rex command and regular expressions, so please bear with.

I'm trying to extract an accountId field from my raw data which is in the following format { "accountId":"C12345678" }

Could someone possibly tell me please how I may strip the actual accountId number out of this line.

Many thanks and kind regards

Tanvi

[s2_splunk]

Is your raw data in JSON format (hard to tell from the snippet). If it is, Splunk will do the field extraction for you.

[tanvi1g]

No, it's apache log

[richgalloway]

Try this.

... | rex "accountId\":\"(?<accountId>[\w]+)" | ...

[cpetterborg]

I would have done it slightly differently (in case there were non-\w characters in the accountId):

... | rex "accountId\":\"(?<accountId>[^\"]+)" | ...

[tanvi1g]

Thanks. I will try this.