Splunk Search

How to extract data using rex?

Learner
Path Finder

Hi all,

I am having data as follows:

REPORT RequestId: xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1

i want a field as CorrelationId3 which is having xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 value

Labels (2)
Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Edited the first answer and should work for space and tabs

|rex "RequestId:\s+(?<CorrelationId3>[^\s]+)"

If the format of the string is only letters,numbers and - then ,you may use

 

|rex "RequestId:\s+(?<CorrelationId3>[a-z0-9A-Z-]+)"

 

Happy Splunking!

View solution in original post

Learner
Path Finder

thank you @renjith_nair for help.  now im again trying to extract correlation_id as CorrelationId4.

{"data":{"correlation_id":"51g0d88f-3ab8-4mom-betb-b31ed6e1662z","u_originator_uri"

 i used following query to extract value:

 | rex "\{\"correlation\_id\"\:\"(?<CorrelationId4>[^\<]*)\s*\""

but now, i am not getting field as CorrelationId4. request you to guide further on this

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

try

correlation_id\":\"(?<CorrelationId4>[^\"]+)
Happy Splunking!
0 Karma

Learner
Path Finder

i have tried 

| rex "correlation_id\\":\\"(?<CorrelationId4>[^\"]+)\\"

but it gives me error as 

Error in 'rex' command: Encountered the following error while compiling the regex 'correlation_id\:\(?<CorrelationId4>[^"]+)\': Regex: unmatched closing parenthesis.

 

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

1. You dont need to use \\ but only single \

2. The last quote (") should not be escaped with \\

Please see below sample

|makeresults|eval _raw="{\"data\":{\"correlation_id\":\"51g0d88f-3ab8-4mom-betb-b31ed6e1662z\",\"u_originator_uri\""
|rex "correlation_id\":\"(?<CorrelationId4>[^\"]+)"
Happy Splunking!
0 Karma

Learner
Path Finder

not getting the data

0 Karma

Learner
Path Finder

not getting the data.

what if data is like:

"{\"data\":{\"correlation_id:\"51g0d88f-3ab8-4mom-betb-b31ed6e1662z\",\"u_originator_uri
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Do you have any characters/strings after the value ?

your search
|rex "RequestId:\s+(?<CorrelationId3>.*)"

If you have any chars after the value , add them after the last parenthesis (")")

Happy Splunking!
0 Karma

Learner
Path Finder

there is more raw data after xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 Duration ---'.

after using using your query, i'm getting data as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 Duration ---'

but i want data as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1'

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

As mentioned, have you tried adding that string after the parenthesis?

 

 

|rex RequestId:\s+(?<CorrelationId3>[^\s]+)

 

 

Happy Splunking!
0 Karma

Learner
Path Finder

yes, but still not getting right answer. i guess there is tab space rather than blank space before Duration. if tab, then how to write that?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Edited the first answer and should work for space and tabs

|rex "RequestId:\s+(?<CorrelationId3>[^\s]+)"

If the format of the string is only letters,numbers and - then ,you may use

 

|rex "RequestId:\s+(?<CorrelationId3>[a-z0-9A-Z-]+)"

 

Happy Splunking!
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...