Splunk Search

How to remove ( \" ) characters from search?

MrIncredible
Explorer

In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different combination by putting quotes but then different error comes.

Regex: https://regex101.com/r/Nm32kd/2

Splunk error: 

MrIncredible_0-1673333693502.png

 

Labels (3)
0 Karma

MrIncredible
Explorer

@gcuselloThanks for your reply. Its not throwing error now though not extracting eligibiltyStatus field as well.

MrIncredible_0-1673337080499.png

MrIncredible_1-1673337142202.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

please try this regex:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>[^\\]+)"

Ciao.

Giuseppe

0 Karma

MrIncredible
Explorer

@gcusello 

error:

MrIncredible_0-1673341534765.png

and if i did some changes (marked in yellow) in regex, not getting error but also not getting desired result:

MrIncredible_1-1673341632786.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

try to add another backslash to your regex in Splunk:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>.*?)\\\"\,\\n"

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...