Splunk Search

How to extract a field with rex for a stats search?

atanasmitev
Path Finder

Hello,

I am having trouble getting rex to work. I have the following :

field1 -> { "param1" : { "param1Status" : "Status INFO", ... "stuff not needed"}}

How do I extract the "Status INFO" message ? I tried :

rex field=field1 ".*param1Status: (?<param1_Status>).*" | stats values(param1_Status) 

which shows no errors, but doesn't extract statistics either. Help ?

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Formatting on here isnt great, ive edited the previous post.. Should be as here also :

rex field=field1 ".*param1Status"\s:\s\"(?<param1_Status>[^"]+)\"

View solution in original post

chimell
Motivator
......| rex  "(?i).*?->{ "/\w+\d"/ : { "/\w+\d\w+"/ :"/(?P<status_info>\w+\s\w+)(?="/),..."/\w+\s\w+\s\w+"/}}"| stats count by status_info
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Formatting on here isnt great, ive edited the previous post.. Should be as here also :

rex field=field1 ".*param1Status"\s:\s\"(?<param1_Status>[^"]+)\"

atanasmitev
Path Finder

It does the job everywhere else but in my Splunk 🙂 so I will further debug my Splunk instance and accept the answer

0 Karma

atanasmitev
Path Finder

I suppose we are almost there, it's could be an error with escaping slashes
as it states now : "Error in 'SearchParser': Missing a search command before '^'. "

Weird is, according to http://regex101.com/ , the above rex is OK and matches exactly as needed.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There needs to be an additional " on the end of the rex.. as I am capturing everything in that capture group up to the ".

search .... | rex field=field1 ".*param1Status"\s:\s\"(?<param1_Status>[^"]+)\"" | stats ...

esix_splunk
Splunk Employee
Splunk Employee

If you're wanting to capture 'Status INFO' without quotes, your regex is wrong. Try;

rex field=field1 ".*param1Status"\s:\s\"(?<param1_Status>[^"]+)\"
0 Karma

atanasmitev
Path Finder

This one above returns mismatched "]"

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...