Splunk Search

How do you turn this test string into a regular expression

Danielle2018V
New Member

Hello

How do you convert the following test string to a regular expression, if the test string contains spaces? Because the string "type" appears several time in the log, to differentiate the instance I need, I need "type" that's followed by a negative amount.

Test string:
"type"=>"fun_bucks", "amount"=>"-$

rex field=_raw type\"=>\"(?[^\"]+)\"\,\ \ \"amount\"=>\"-\$

Example log text
"type"=>"fun_bucks", "amount"=>"-$21.00", "request_id_link"=>{"content"=>nil, "href"=>"https://ebc.cybersource.com/ebc/transactionsearch/TransactionSearchDetailsLoad.do?requestId="}, "status"=>"succeeded", "action"=>"refund", "convert_to_cash_url"=>nil}], "v2_return_service_enabled"=>true, "inventory_service_id"=>"voucher", "order_reversal_url"=>"/order_reversal/refund",

0 Karma
1 Solution

hos_2
Path Finder

Hi Danielle2018V,

You need to define the spaces in your regex with \s, for example:

type\"\=\>\"(?<test>\w+)\"\,\s\"amount\"\=\>\"(?<test2>\S+)\"

This will create 2 fields called test and test2, test will be the name of the account (in this case "fun_bucks") and test2 will be the dollar amount (in this case -$21.00)

Then you can use search or where commands to do the rest of the filtering

View solution in original post

0 Karma

hos_2
Path Finder

Hi Danielle2018V,

You need to define the spaces in your regex with \s, for example:

type\"\=\>\"(?<test>\w+)\"\,\s\"amount\"\=\>\"(?<test2>\S+)\"

This will create 2 fields called test and test2, test will be the name of the account (in this case "fun_bucks") and test2 will be the dollar amount (in this case -$21.00)

Then you can use search or where commands to do the rest of the filtering

0 Karma

hos_2
Path Finder

I forgot to mention that there is a great place to test your code and it has a codex of regex commands to reference.

https://regex101.com/

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...