How to extract a field from my raw data using rex?

[alexspunkshell]

Below is my raw logs.

I want to extract "analystVerdict" & its corresponding result from raw logs. can someone please help

\"mitigationStartedAt\": \"2022-04-13T03:57:58.393000Z\", \"status\": \"success\"}], \"threatInfo\": {\"analystVerdict\": \"false_positive\", \"analystVerdictDescription\": \"False positive\", \"automaticallyResolved\": false, \"browserType\": null, \"certificateId\": \"\", \"classification\": \"Malware\",

I tried below. But i am failing to get the result

index=test_summary  | rex field=_raw ":\\\"(?<analystVerdict>\w+)\\\"" |table search_name analystVerdict

[ITWhisperer · Accepted solution]

| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"

[gcusello]

Hi @alexspunkshell,

please try this regex:

| rex "analystVerdictDescription\\\":\s+\\\"(?<analystVerdictDescription>[^\"]+)"

that you can test at https://regex101.com/r/IjwJYM/1

Ciao.

Giuseppe

[alexspunkshell]

@gcusello  Thanks for your help

I tried but the field is empty in my results. But the raw logs is having the values.

[gcusello]

Hi @alexspunkshell,

sometimes I found a behaviour in Splunk different than regex101, so please try this:

| rex "analystVerdictDescription\\\\":\s+\\\\"(?<analystVerdictDescription>[^\"]+)"

Ciao.

Giuseppe

[alexspunkshell]

Still the same

[isoutamo]

If you really have that \ as an escape character on your data, you should add could of more \ character on your rex. There reason is that internally there are couple of places where splunk do that de-escaping and for that reason sometimes you need to do it double or triple times.