Splunk Search
Highlighted

How do I write a regular expression to extract 2 fields from my sample data?

Contributor

So I have a search that will check if two variables equal a specific number, and then I get the count of these instances. I am having trouble regexing the numbers I needed to create the variables.

index=nitroprodecomm errorCode |rex (This grabs the Response Code) | rex (This grabs Error Code) | where RespCode = 400 AND ErrorCode = 1001 | table count

REQUESTBODY:
{profileId:0156",deviceId:D893-4324234234C"}
RESPONSE
CODE:400
RESPONSETIME:2
RESPONSE
HEADERS:
Date:Wed, 14 Sep 2016 15:10:17 GMT;
X-Powered-By:Servlet/3.0;
correlation-id:NAID-iOS-E6B4F6817.94320;
channel:IOS;
Content-Type:application/json;
Transfer-Encoding:chunked;
Connection:Close;
RESPONSE_BODY:
{"errors":[{"errorCode":"1001","message":""}]}

WSHAPRTWLMVERSION:-1;
RESPONSE
CODE:500
RESPONSETIME:11
RESPONSE
HEADERS:
X-Powered-By:Servlet/3.0;
correlation-id:TID-14743243247;
Content-Type:application/json;
Transfer-Encoding:chunked;
Connection:Close;
Date:Wed, 14 Sep 2016 15:33:13 GMT;
RESPONSE_BODY:
{"errors":[{"errorCode":"1010","message":""}]}

0 Karma
Highlighted

Re: How do I write a regular expression to extract 2 fields from my sample data?

Contributor

you could try those two:

rex field=_raw "RESPONSE_CODE:(?P<RespCode>\d+)"

rex field=_raw "errorCode\":\"(?P<ErrorCode>\d+)"

Edit: escaped quotes and used + thanks to richgalloway

0 Karma
Highlighted

Re: How do I write a regular expression to extract 2 fields from my sample data?

SplunkTrust
SplunkTrust

The quotes with the regex will have to be escaped.
I prefer to use \d+ to avoid assumptions about the length of a number.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How do I write a regular expression to extract 2 fields from my sample data?

SplunkTrust
SplunkTrust

Try this

index=nitro_prod_ecomm errorCode |rex "RESPONSE_CODE:(?<RespCode>\d+)" | rex "\"errorCode\":\"(?<ErrorCode>\d+)\"" | where RespCode = 400 AND ErrorCode = 1001 | stats count
0 Karma
Highlighted

Re: How do I write a regular expression to extract 2 fields from my sample data?

Legend

Try these two regex

... | rex "errorCode\"\:\"(?<err_code>\d+)\"" | rex "RESPONSE_CODE\:(?<resp_code>\d+)"

View solution in original post