Splunk Search

Need help in field extraction

Path Finder

In the below log, I need to extract genres from the log. In a single log there are multiple genres. Such as for the below log , we have 3 genres ---( Comedy, Drama and Romance).

My requirement is to map genres with ID.

0,"[{""id"": 35, ""name"": ""Comedy""}, {""id"": 18, ""name"": ""Drama""}, {""id"": 10749, ""name"": ""Romance""}, {""id"": 10770, ""name"": ""TV Movie""}]",http://www.hallmarkchannel.com/signedsealeddelivered,231617,"[{""id"": 248, ""name"": ""date""}, {""id"": 699, ""name"": ""love at first sight""}, {""id"": 2398, ""name"": ""narration""}, {""id"": 5340, ""name"": ""investigation""}, {""id"": 34051, ""name"": ""team""}, {""id"": 173066, ""name"": ""postal worker""}]",en,"Signed, Sealed, Delivered","""Signed, Sealed, Delivered"" introduces a dedicated quartet of civil servants in the Dead Letter Office of the U.S. Postal System who transform themselves into an elite team of lost-mail detectives. Their determination to deliver the seemingly undeliverable takes them out of the post office into an unpredictable world where letters and packages from the past save lives, solve crimes, reunite old loves, and change futures by arriving late, but always miraculously on time.",1.444476,"[{""name"": ""Front Street Pictures"", ""id"": 3958}, {""name"": ""Muse Entertainment Enterprises"", ""id"": 6438}]","[{""iso_3166_1"": ""US"", ""name"": ""United States of America""}]",2013-10-13,0,120,"[{""iso_639_1"": ""en"", ""name"": ""English""}]",Released,,"Signed, Sealed, Delivered",7.0,6

1 Solution

Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma

Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma

Path Finder

Thanks Sir..

SplunkTrust
SplunkTrust

Hi vikcee,
try something like this:

| rex "\{\"\"\w+\"\":\s+\w+,\s+\"\"\w+\"\":\s\"\"(?<genres>[^\"]*)"

that you can test at https://regex101.com/r/ERdRYl/1

Ciao.
Giuseppe

0 Karma

Builder

Looks like JSON - what happens if you tell Splunk to ingest your sample as JSON?

0 Karma

Communicator

Hi Vikcee,

Please try the below regex. Hope this helps you to find it.

rex field=_raw """(?P[A-Z][a-z]+)"""

0 Karma

SplunkTrust
SplunkTrust

@vikcee

Full sample event in code block and expected out will help us to address your issue.

0 Karma