Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I extract a long string with double quotes ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Example 1:
time="2021-02-26T04:20:27Z" level=error msg="[xx] failed processing case" caseNumber=1234 error="Received bad status code for case processing. StatusCode: [500]. Error: [{\"response\": \"strconv.ParseInt: parsing \"\": invalid syntax\", \"status\": false}]." role=x spEnv=x spZone=x userID=x
I want to extract string "Received bad status code for case processing. StatusCode: [500]. Error: [{\"response\": \"strconv.ParseInt: parsing \"\": invalid syntax\", \"status\": false}]."
Example 2:
time="2021-03-01T23:50:02Z" level=error msg="[xx] failed processing case" caseNumber=13423 error="Received unexpected status code 400 for POST request. Path: /v1/user Request: {\"cloudZone\":[{\"cloud\":\"x\",\"zone\":\"x\"}],\"userDetails\":{\"userName\":\"x\",\"fullName\":\"x\",\"employee\":{\"employeeId\":\"x\",\"emailId\":\"x\",\"lockout\":false,\"enabled\":true,\"kkk\":false},\"description\":\"24784\",\"idNumber\":123,\"groupId\":123}} Response: {\"code\":\"\",\"reason\":\"[DS] Number 123 is already used\",\"request-id\":\"884F74A7-E249-1649-57B7-2C12E807DEDA\"}\n" role=x spEnv=x spZone=x userID=x
I want to extract string "Received unexpected status code 400 for POST request. Path: /v1/user Request: {\"cz\":[{\"c\":\"x\",\"z\":\"x\"}],\"userDetails\":{\"userName\":\"x\",\"fullName\":\"x\",\"employee\":{\"employeeId\":\"x\",\"emailId\":\"x\",\"lockout\":false,\"enabled\":true,\"kkk\":false},\"description\":\"24784\",\"idNumber\":123,\"groupId\":123}} Response: {\"code\":\"\",\"reason\":\"[DS] Number 123 is already used\",\"request-id\":\"884F74A7-E249-1649-57B7-2C12E807DEDA\"}\n"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this in a search:
| rex "error=\"(?<error>(?:\\\\\"|[^\"])+)"
Or in an inline transform:
error="(?<error>(?:\\"|[^"])+)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this in a search:
| rex "error=\"(?<error>(?:\\\\\"|[^\"])+)"
Or in an inline transform:
error="(?<error>(?:\\"|[^"])+)
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
