Splunk Search

Need help in field extraction

vikcee
Path Finder

In the below log, I need to extract genres from the log. In a single log there are multiple genres. Such as for the below log , we have 3 genres ---( Comedy, Drama and Romance).

My requirement is to map genres with ID.

0,"[{""id"": 35, ""name"": ""Comedy""}, {""id"": 18, ""name"": ""Drama""}, {""id"": 10749, ""name"": ""Romance""}, {""id"": 10770, ""name"": ""TV Movie""}]",http://www.hallmarkchannel.com/signedsealeddelivered,231617,"[{""id"": 248, ""name"": ""date""}, {""id"": 699, ""name"": ""love at first sight""}, {""id"": 2398, ""name"": ""narration""}, {""id"": 5340, ""name"": ""investigation""}, {""id"": 34051, ""name"": ""team""}, {""id"": 173066, ""name"": ""postal worker""}]",en,"Signed, Sealed, Delivered","""Signed, Sealed, Delivered"" introduces a dedicated quartet of civil servants in the Dead Letter Office of the U.S. Postal System who transform themselves into an elite team of lost-mail detectives. Their determination to deliver the seemingly undeliverable takes them out of the post office into an unpredictable world where letters and packages from the past save lives, solve crimes, reunite old loves, and change futures by arriving late, but always miraculously on time.",1.444476,"[{""name"": ""Front Street Pictures"", ""id"": 3958}, {""name"": ""Muse Entertainment Enterprises"", ""id"": 6438}]","[{""iso_3166_1"": ""US"", ""name"": ""United States of America""}]",2013-10-13,0,120,"[{""iso_639_1"": ""en"", ""name"": ""English""}]",Released,,"Signed, Sealed, Delivered",7.0,6

1 Solution

woodcock
Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma

vikcee
Path Finder

Thanks Sir..

gcusello
Legend

Hi vikcee,
try something like this:

| rex "\{\"\"\w+\"\":\s+\w+,\s+\"\"\w+\"\":\s\"\"(?<genres>[^\"]*)"

that you can test at https://regex101.com/r/ERdRYl/1

Ciao.
Giuseppe

0 Karma

wmyersas
Builder

Looks like JSON - what happens if you tell Splunk to ingest your sample as JSON?

0 Karma

kartm2020
Communicator

Hi Vikcee,

Please try the below regex. Hope this helps you to find it.

rex field=_raw """(?P[A-Z][a-z]+)"""

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vikcee

Full sample event in code block and expected out will help us to address your issue.

0 Karma