Need help in field extraction

[vikcee]

In the below log, I need to extract genres from the log. In a single log there are multiple genres. Such as for the below log , we have 3 genres ---( Comedy, Drama and Romance).

My requirement is to map genres with ID.

0,"[{""id"": 35, ""name"": ""Comedy""}, {""id"": 18, ""name"": ""Drama""}, {""id"": 10749, ""name"": ""Romance""}, {""id"": 10770, ""name"": ""TV Movie""}]",http://www.hallmarkchannel.com/signedsealeddelivered,231617,"[{""id"": 248, ""name"": ""date""}, {""id"": 699, ""name"": ""love at first sight""}, {""id"": 2398, ""name"": ""narration""}, {""id"": 5340, ""name"": ""investigation""}, {""id"": 34051, ""name"": ""team""}, {""id"": 173066, ""name"": ""postal worker""}]",en,"Signed, Sealed, Delivered","""Signed, Sealed, Delivered"" introduces a dedicated quartet of civil servants in the Dead Letter Office of the U.S. Postal System who transform themselves into an elite team of lost-mail detectives. Their determination to deliver the seemingly undeliverable takes them out of the post office into an unpredictable world where letters and packages from the past save lives, solve crimes, reunite old loves, and change futures by arriving late, but always miraculously on time.",1.444476,"[{""name"": ""Front Street Pictures"", ""id"": 3958}, {""name"": ""Muse Entertainment Enterprises"", ""id"": 6438}]","[{""iso_3166_1"": ""US"", ""name"": ""United States of America""}]",2013-10-13,0,120,"[{""iso_639_1"": ""en"", ""name"": ""English""}]",Released,,"Signed, Sealed, Delivered",7.0,6

[woodcock · Accepted solution]

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

[vikcee]

Thanks Sir..

[gcusello]

Hi vikcee,
try something like this:

| rex "\{\"\"\w+\"\":\s+\w+,\s+\"\"\w+\"\":\s\"\"(?<genres>[^\"]*)"

that you can test at https://regex101.com/r/ERdRYl/1

Ciao.
Giuseppe

[wmyersas]

Looks like JSON - what happens if you tell Splunk to ingest your sample as JSON?

[kartm2020]

Hi Vikcee,

Please try the below regex. Hope this helps you to find it.

rex field=_raw """(?P[A-Z][a-z]+)"""

[kamlesh_vaghela]

@vikcee

Full sample event in code block and expected out will help us to address your issue.