Splunk Search

How to remove ( \" ) characters from search?

MrIncredible
Explorer

In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different combination by putting quotes but then different error comes.

Regex: https://regex101.com/r/Nm32kd/2

Splunk error: 

MrIncredible_0-1673333693502.png

 

Labels (3)
0 Karma

MrIncredible
Explorer

@gcuselloThanks for your reply. Its not throwing error now though not extracting eligibiltyStatus field as well.

MrIncredible_0-1673337080499.png

MrIncredible_1-1673337142202.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

please try this regex:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>[^\\]+)"

Ciao.

Giuseppe

0 Karma

MrIncredible
Explorer

@gcusello 

error:

MrIncredible_0-1673341534765.png

and if i did some changes (marked in yellow) in regex, not getting error but also not getting desired result:

MrIncredible_1-1673341632786.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

try to add another backslash to your regex in Splunk:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>.*?)\\\"\,\\n"

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...