Splunk Search

Need help in field extraction

vikcee
Path Finder

In the below log, I need to extract genres from the log. In a single log there are multiple genres. Such as for the below log , we have 3 genres ---( Comedy, Drama and Romance).

My requirement is to map genres with ID.

0,"[{""id"": 35, ""name"": ""Comedy""}, {""id"": 18, ""name"": ""Drama""}, {""id"": 10749, ""name"": ""Romance""}, {""id"": 10770, ""name"": ""TV Movie""}]",http://www.hallmarkchannel.com/signedsealeddelivered,231617,"[{""id"": 248, ""name"": ""date""}, {""id"": 699, ""name"": ""love at first sight""}, {""id"": 2398, ""name"": ""narration""}, {""id"": 5340, ""name"": ""investigation""}, {""id"": 34051, ""name"": ""team""}, {""id"": 173066, ""name"": ""postal worker""}]",en,"Signed, Sealed, Delivered","""Signed, Sealed, Delivered"" introduces a dedicated quartet of civil servants in the Dead Letter Office of the U.S. Postal System who transform themselves into an elite team of lost-mail detectives. Their determination to deliver the seemingly undeliverable takes them out of the post office into an unpredictable world where letters and packages from the past save lives, solve crimes, reunite old loves, and change futures by arriving late, but always miraculously on time.",1.444476,"[{""name"": ""Front Street Pictures"", ""id"": 3958}, {""name"": ""Muse Entertainment Enterprises"", ""id"": 6438}]","[{""iso_3166_1"": ""US"", ""name"": ""United States of America""}]",2013-10-13,0,120,"[{""iso_639_1"": ""en"", ""name"": ""English""}]",Released,,"Signed, Sealed, Delivered",7.0,6

1 Solution

woodcock
Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

0 Karma

vikcee
Path Finder

Thanks Sir..

gcusello
SplunkTrust
SplunkTrust

Hi vikcee,
try something like this:

| rex "\{\"\"\w+\"\":\s+\w+,\s+\"\"\w+\"\":\s\"\"(?<genres>[^\"]*)"

that you can test at https://regex101.com/r/ERdRYl/1

Ciao.
Giuseppe

0 Karma

wmyersas
Builder

Looks like JSON - what happens if you tell Splunk to ingest your sample as JSON?

0 Karma

kartm2020
Communicator

Hi Vikcee,

Please try the below regex. Hope this helps you to find it.

rex field=_raw """(?P[A-Z][a-z]+)"""

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vikcee

Full sample event in code block and expected out will help us to address your issue.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...