Splunk Search

How to write regex to filter events in JSON format?

p_gurav
Champion

Hi,
Kindly help me with this issue:

{"sim-slot":"0","terminal-vendor":"Vendor","default-sms-app":"own","screen-orientation":"portrait","response-code":"200","secondary-device-type":"","international":"0","subject-region":"Lat=0,Lon=0,Alt=0,Acc=0","locale":"en_US","timestamp":"2017-01-19T13:24:22.986+00:00","user-agent":"IM-client/OMA1.0 model/brand-5.1 RCSAndrd/0.0.0 COMLib/0.00.00.rev00000","evt-client-version":"0.0.0","active-cs-call":"no","sbc-ip":"99.99.9.999:9999","transaction-id":"9aa99a9a-9aa9-99a9-a999-a9a9a999aa00","init-service-tag":"audiocall","description":"call-sip-invite-parent","call-id":"ZZZZZZZZZZZ","app-state":"foreground","module":"cs","terminal-sw-version":"0.0","imsi":"99999999999","remote-peer":"+99999999999","cell-id":"99999","platform":"phone-android","client-version":"3.10.32.rev74692","direction":"outgoing","network-bearer":"CELLULAR_LTE","terminal-model":"Model","sim":"mcc(000),mnc(000)","result":"success","identity":"+999999999999","device-id":"imei(9999999999),tac(99999)"}

This is my sample log and i need to filter out events having specifically description:call-sip-invite-parent AND response-code:200.
Events having response-code other than 200 for description:call-sip-invite-parent should be indexed.Kindly help with the regex

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this (on our indexers):

props.conf:

[YourSourcetypeHere]
TRANSFORMS-t1=eliminate-RC200-and-CSIP

transforms.conf:

[eliminate-RC200-and-CSIP]
REGEX = (?ms)\"response-code\":\"200\".*\"description\":\"call-sip-invite-parent\"
DEST_KEY = queue
FORMAT = nullQueue

Bounce splunkd on each indexer and all future events to be indexed will be filtered.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi p_gurav,
this the regex to extract your two fields.

\"response-code\":\"(?<responsecode>[^\"]*)\".*\"description\":\"(?<description>[^\"]*)\"

you can test it at https://regex101.com/r/3RcXn1/1

Bye.
Giuseppe

0 Karma

p_gurav
Champion

Hi Cusello,

Thanks for your reguler expression. I think their is confusion I want to send this kind of events to nullQueue for which I required REGEX stanza to be add into transforms.conf.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok no problem,
try this regex

\"response-code\":\"200\".*\"description\":\"call-sip-invite-parent\"

before you can test it in Splunk using regex command and if it's Ok put in transforms.conf.
Bye.
Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...