Splunk Search

Need Help in regex expression

rkishoreqa
Communicator

Hi team, 

 

I need to fetch the 'InterfaceName' from the below payload.  I built a regular expression but it is not working as expression. Can someone please verify this and correct me where I am wrong. 

"xmlns:bw":"http://www.tibco.com"
"ns:InterfaceName":"MIAP-COVGBA",
"ns:CorrelationID":"f84nvkdwe-4ij43kj"

I created one regex expression like - | rex field=_raw "ns:InterfaceName\W+(?<AppId>\w+)" |stats count by AppId.  

From the above expression I am getting only double quotes ("), but unable to fetch data. 

 

Thanks in advance.

 

yours,

...

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's an alternative regex to try.

ns:InterfaceName\\\":\\\"(?<AppId>[^\\\"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Here's an alternative regex to try.

ns:InterfaceName\\\":\\\"(?<AppId>[^\\\"]+)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...