Splunk Search

How to extract a field from my raw data using rex?

alexspunkshell
Contributor

Below is my raw logs.

I want to extract "analystVerdict" & its corresponding result from raw logs. can someone please help

 

\"mitigationStartedAt\": \"2022-04-13T03:57:58.393000Z\", \"status\": \"success\"}], \"threatInfo\": {\"analystVerdict\": \"false_positive\", \"analystVerdictDescription\": \"False positive\", \"automaticallyResolved\": false, \"browserType\": null, \"certificateId\": \"\", \"classification\": \"Malware\",

 

I tried below. But i am failing to get the result

index=test_summary  | rex field=_raw ":\\\"(?<analystVerdict>\w+)\\\"" |table search_name analystVerdict

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "analystVerdict\\\\\":\s+\\\\\"(?<analystVerdictDescription>[^\\\\\"]+)"

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

please try this regex:

| rex "analystVerdictDescription\\\":\s+\\\"(?<analystVerdictDescription>[^\"]+)"

that you can test at https://regex101.com/r/IjwJYM/1

Ciao.

Giuseppe

alexspunkshell
Contributor

@gcusello  Thanks for your help

I tried but the field is empty in my results. But the raw logs is having the values.

alexspunkshell_0-1650469176646.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

sometimes I found a behaviour in Splunk different than regex101, so please try this:

| rex "analystVerdictDescription\\\\":\s+\\\\"(?<analystVerdictDescription>[^\"]+)"

Ciao.

Giuseppe

alexspunkshell
Contributor

Still the same

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you really have that \ as an escape character on your data, you should add could of more \ character on your rex. There reason is that internally there are couple of places where splunk do that de-escaping and for that reason sometimes you need to do it double or triple times.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...