Splunk Search

I'm trying to extract field That looks like below

PavanSeerapu
Explorer

I'm trying to extract field That looks like "Alert-source-key":"[\"abcdd-gdfc-mb40-a801-e40fd9db481e\"]"

 

 

I have tried this "Alert-source-key":"(?P<Alert_key>[^"]+)" but i'm getting results like "[/" since it is checking for only 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

PavanSeerapu
Explorer

What exactly are you trying to extract from that string? -- abcdd-gdfc-mb40-a801-e40fd9db481e

I'm using field extractor through splunk web and writing the regular expression by myself

0 Karma

isoutamo
SplunkTrust
SplunkTrust

This seems to work

| makeresults 
| eval foo = "\"Alert-source-key\":\"[\\\"abcdd-gdfc-mb40-a801-e40fd9db481e\\\"]\"" 
| rex field=foo "\"Alert-source-key\":\"\[\\\\\"(?P<Alert_key>[^\"\\\]+)"

In this kind of cases there are needed "couple" of escapes \.

r. Ismo 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

What exactly are you trying to extract from that string?  Where and how are you doing so?

If you're trying to extract the field using the rex command in a search then the embedded quotation marks must be escaped.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...