Splunk Search

How to extract a field from my raw data using rex?

alexspunkshell
Contributor

Below is my raw logs.

I want to extract "analystVerdict" & its corresponding result from raw logs. can someone please help

 

\"mitigationStartedAt\": \"2022-04-13T03:57:58.393000Z\", \"status\": \"success\"}], \"threatInfo\": {\"analystVerdict\": \"false_positive\", \"analystVerdictDescription\": \"False positive\", \"automaticallyResolved\": false, \"browserType\": null, \"certificateId\": \"\", \"classification\": \"Malware\",

 

I tried below. But i am failing to get the result

index=test_summary  | rex field=_raw ":\\\"(?<analystVerdict>\w+)\\\"" |table search_name analystVerdict

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

please try this regex:

| rex "analystVerdictDescription\\\":\s+\\\"(?<analystVerdictDescription>[^\"]+)"

that you can test at https://regex101.com/r/IjwJYM/1

Ciao.

Giuseppe

alexspunkshell
Contributor

@gcusello  Thanks for your help

I tried but the field is empty in my results. But the raw logs is having the values.

alexspunkshell_0-1650469176646.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

sometimes I found a behaviour in Splunk different than regex101, so please try this:

| rex "analystVerdictDescription\\\\":\s+\\\\"(?<analystVerdictDescription>[^\"]+)"

Ciao.

Giuseppe

alexspunkshell
Contributor

Still the same

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you really have that \ as an escape character on your data, you should add could of more \ character on your rex. There reason is that internally there are couple of places where splunk do that de-escaping and for that reason sometimes you need to do it double or triple times.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...