Splunk Search

I'm trying to extract field That looks like below

PavanSeerapu
Explorer

I'm trying to extract field That looks like "Alert-source-key":"[\"abcdd-gdfc-mb40-a801-e40fd9db481e\"]"

 

 

I have tried this "Alert-source-key":"(?P<Alert_key>[^"]+)" but i'm getting results like "[/" since it is checking for only 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

PavanSeerapu
Explorer

What exactly are you trying to extract from that string? -- abcdd-gdfc-mb40-a801-e40fd9db481e

I'm using field extractor through splunk web and writing the regular expression by myself

0 Karma

isoutamo
SplunkTrust
SplunkTrust

This seems to work

| makeresults 
| eval foo = "\"Alert-source-key\":\"[\\\"abcdd-gdfc-mb40-a801-e40fd9db481e\\\"]\"" 
| rex field=foo "\"Alert-source-key\":\"\[\\\\\"(?P<Alert_key>[^\"\\\]+)"

In this kind of cases there are needed "couple" of escapes \.

r. Ismo 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex works in regex101.com and should also work in the Field Extractor.

Alert-source-key":"\[\\"(?<AlertSource>[^\\]+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What exactly are you trying to extract from that string?  Where and how are you doing so?

If you're trying to extract the field using the rex command in a search then the embedded quotation marks must be escaped.

---
If this reply helps you, an upvote would be appreciated.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!