Splunk Search

How to remove ( \" ) characters from search?

MrIncredible
Explorer

In few logs I can see escape character is also printed. My rex is working fine when i am testing it on regex101.com but when i use the same in Splunk Search, its throwing error. I tried different combination by putting quotes but then different error comes.

Regex: https://regex101.com/r/Nm32kd/2

Splunk error: 

MrIncredible_0-1673333693502.png

 

Labels (3)
0 Karma

MrIncredible
Explorer

@gcuselloThanks for your reply. Its not throwing error now though not extracting eligibiltyStatus field as well.

MrIncredible_0-1673337080499.png

MrIncredible_1-1673337142202.png

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

please try this regex:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>[^\\]+)"

Ciao.

Giuseppe

0 Karma

MrIncredible
Explorer

@gcusello 

error:

MrIncredible_0-1673341534765.png

and if i did some changes (marked in yellow) in regex, not getting error but also not getting desired result:

MrIncredible_1-1673341632786.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrIncredible,

try to add another backslash to your regex in Splunk:

| rex "eligibiltyStatus\\\": \\\"(?<eligibiltystatus>.*?)\\\"\,\\n"

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...