Splunk Search

How to extract using rex

avi7326
Path Finder

 I want to extract the below contractWithCustomers and  contracts  using rex named as entity . 
For ID 1349c1f4-989c-4ea5-94ca-25fc40f6aab8 -flow started put:\contractWithCustomers:application\json:bmw-crm-wh-xl-cms-api-config

For ID 1697108895 -flow started put:\contracts:application\json:bmw-crm-wh-xl-cms-api-config

avi7326_0-1698331179533.png

 



 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "put:\\\\(?<Entity>[^:]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

What would the expected output look like?

0 Karma

avi7326
Path Finder

In table want a field name as -
Entity 
contractWithCustomers
contracts

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "put:\\\\(?<Entity>[^:]+)"
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...